MathWorks Response to CVE-2026-109618 and CVE-2026-109619 PHP2Shell Vulnerabilities

Security researchers disclosed the following vulnerabilities in the PHP engine, collectively referred to as PHP2Shell:

• CVE-2026-109618: PHP does not properly handle certain out-of-memory conditions, which may result in memory corruption and allow remote code execution. 
• CVE-2026-109619: PHP does not properly manage certain request-owned global state, which may result in use of stale memory and allow remote code execution.

MathWorks conducted an assessment across our desktop, server, and online applications for the mentioned vulnerabilities: 

• No MathWorks general release desktop or server products include an affected version of PHP.
• The only MathWorks online application using an affected version of PHP, MathWorks Blogs,  has been updated with a version containing the vendor-provided fixes.
• Our investigation found no evidence of exploitation of these vulnerabilities within the impacted MathWorks environments.

There is no additional action required from customers. MathWorks will continue to monitor this set of issues for any potential impact on our products and services.