On October 21, 2026, the PHP project disclosed two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell" — affecting nearly all PHP web deployments. We applied the official PHP security patch to our infrastructure as soon as it was released. We have found no evidence that Waydev systems or customer data were affected or targeted. No action is required on your part. Please reach out to our support team with any questions or concerns.