On October 21, 2026, the PHP and Node.js projects released fixes for serious vulnerabilities, including “php2shell” (CVE-2026-109618 and CVE-2026-109619), a remote code execution flaw in PHP. These are industry-wide issues affecting a large share of the web.
Our response. We opened our response the same day and worked from an inventory of what we actually run. Where an immediate upgrade wasn’t possible, we applied the published protections first. We then patched and verified our services one by one, under change control. By early October 23, every Clinic production service was patched or protected.
What we found. We have found no evidence that these vulnerabilities were exploited on our systems. We continue to monitor.
What customers need to do. Nothing. The fixes were on our side.
Customers with questions can contact their Customer Success manager. Security teams completing a vendor review can request more detail at help@vsee.com
