Security update: Industry-wide PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Summary
On October 21, 2026, the PHP project released fixes for two critical remote code execution (RCE) vulnerabilities, known as PHP2Shell. PHP is one of the most widely used web technologies in the world, so this affects organizations across every industry. Details leaked before the coordinated disclosure, and exploitation attempts have been reported worldwide. 

The Smartsheet application does not use PHP and is not affected. Like many organizations, we use PHP on some of our marketing websites, but we have fully remediated relevant vulnerabilities. We are not aware of any impact to customer data or accounts.

What happened
On October 21, 2026, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP, a widely used server-side scripting language. Both are rated Critical (CVSS 9.2). They can be exploited over the network without privileges or user interaction.

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Both relate to how PHP handles memory when a request ends abnormally, such as through memory exhaustion or a fatal error. Under certain conditions, an attacker could use this to run code remotely.

Affected and fixed versions:

• Affected: PHP 5.4 through 8.5.11
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Smartsheet current status (as of October 27, 2026)

• Smartsheet application: Remains unaffected. It has no components that use PHP, so no customer environment is impacted.
• Marketing websites and Internet-accessible systems: Fully remediated. Patched versions are deployed, and our scanning confirms these systems are no longer vulnerable. This includes the supporting services behind our marketing forms and webhooks.
• Remaining internal systems: A small subset of systems is waiting for vendor patches that have not yet been released. These components are not part of the Smartsheet product and are not reachable from the Internet. We are tracking them closely and will apply patches as soon as vendors release them.
• Other internal systems: Patched under our standard critical-severity timelines.

We take vulnerabilities like this seriously, and protecting our customers and their data remains a top priority. We will continue to monitor the situation closely and update this notice if anything changes. Please contact Smartsheet Support with any questions

Smartsheet current status (as of October 23, 2026, 12:56 PM PDT)

• The Smartsheet application remains unaffected. It has no components that use PHP, so no customer environment is impacted.
• Marketing websites: Patched versions are now deployed to the systems hosting the majority of our marketing sites, and our scanning confirms they are no longer vulnerable. We also updated the supporting services behind our marketing forms and webhooks.
• Remaining work: A small number of remaining items are still being remediated, and we are tracking them closely.
• Internal systems continue to be patched under our standard critical-severity timelines.

We will continue to monitor the situation closely and update this notice if anything changes. Please contact Smartsheet Support with any questions.
 

Smartsheet Current Status (as of October 22, 2026 3:22 PM PDT)

• The Smartsheet application is not affected. It has no components that use PHP and therefore no customer environment is impacted. 
• Marketing websites: We identified the affected sites and prioritized the publicly accessible ones. Most were updated with patched PHP versions this morning and no longer show vulnerable versions in our scanning as of 11am PDT.  A small number of remaining systems are being remediated. 
• Consistent with our response to critical vulnerabilities, our security operations team is tracking remediation as a security incident to ensure it is completed quickly.
• Internal systems are being patched under our standard critical-severity timelines.

We will keep monitoring the situation and update this notice if anything changes. Please contact Smartsheet Support for any questions.