Security update: Industry-wide PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Summary
On October 21, 2026, the PHP project released fixes for two critical remote code execution (RCE) vulnerabilities, known as PHP2Shell. PHP is one of the most widely used web technologies in the world, so this affects organizations across every industry. Details leaked before the coordinated disclosure, and exploitation attempts have been reported worldwide. 

The Smartsheet application does not use PHP and is not affected. Like many organizations, we use PHP on some of our marketing websites. We have patched most of them and are finishing the rest. We are not aware of any impact to customer data or accounts.

What happened
On October 21, 2026, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP, a widely used server-side scripting language. Both are rated Critical (CVSS 9.2). They can be exploited over the network without privileges or user interaction.

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Both relate to how PHP handles memory when a request ends abnormally, such as through memory exhaustion or a fatal error. Under certain conditions, an attacker could use this to run code remotely.

Affected and fixed versions:

• Affected: PHP 5.4 through 8.5.11
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Smartsheet current status (as of October 23, 2026, 12:56 PM PDT)

• The Smartsheet application remains unaffected. It has no components that use PHP, so no customer environment is impacted.
• Marketing websites: Patched versions are now deployed to the systems hosting the majority of our marketing sites, and our scanning confirms they are no longer vulnerable. We also updated the supporting services behind our marketing forms and webhooks.
• Remaining work: A small number of remaining items are still being remediated, and we are tracking them closely.
• Internal systems continue to be patched under our standard critical-severity timelines.

We take vulnerabilities like this seriously, and protecting our customers and their data remains a top priority. We will continue to monitor the situation closely and update this notice if anything changes. Please contact Smartsheet Support with any questions.