Vendor reports: operationalResolved · vendor status “resolved”Official status API

PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Reported by Auvik · Observability & Incident · source last read just now

Official source (opens in a new tab)
Vendor start
Oct 21, 2026, 15:06 UTC
Vendor's clock
Resolved
Oct 22, 2026, 12:33 UTC
Vendor's clock
First seen by Statuswall
Before tracking began
Statuswall's clock
Duration
21 h 27 min
From vendor start and resolution

Summary

Built from the facts below, no AI

Potential impact, not a confirmed outage of your systems.

What the vendor confirmed

  • Auvik reports operational: "PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)".[E1, E2]
  • The vendor marked it resolved at 2026-10-22 12:33 UTC.[E3, E7]

Affected products and regions

  • Components: Auvik Website (www.auvik.com).[E6]

What is unknown

  • Which regions are affected: the vendor did not say.[E5]
  • Whether your own systems are affected: a vendor report cannot tell you; check your monitoring.

Last update in these facts: 2026-10-22 12:33 UTC · summary s1, evidence ff18a7fdc98da9c1

Evidence (7)
  1. E1Auvik reports operational. (vendor) source (opens in a new tab)
  2. E2Vendor title: "PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)". (vendor) source (opens in a new tab)
  3. E3Vendor status word: "resolved". (vendor) source (opens in a new tab)
  4. E4Vendor-reported start: 2026-10-21 15:06 UTC. (vendor) source (opens in a new tab)
  5. E5The vendor did not state which regions are affected. (Statuswall)
  6. E6Components the vendor attached: Auvik Website (www.auvik.com). (vendor) source (opens in a new tab)
  7. E7Vendor-reported resolution: 2026-10-22 12:33 UTC. (vendor) source (opens in a new tab)

Affected scope

Not stated by the vendor

Components: Auvik Website (www.auvik.com)

The vendor's feed gives no region for this incident. It is not assumed to be global.

Potential relevance

Auvik is not in your stack. Follow it to see whether reports like this fall inside the regions you use.

Timeline

Vendor times come from the vendor. “Seen by Statuswall” times are when Statuswall noticed a change, which can lag the vendor by a few minutes. Statuswall does not store the vendor's update text; read it on the official page.

  1. Oct 21, 2026, 15:06 UTCVendor-reported startVendor time
  2. Oct 22, 2026, 12:33 UTCVendor-reported resolutionVendor time

No changes observed yet. Statuswall began recording changes on incidents in November 2026.