Security Vulnerability - PHP2Shell

Issue:

https://nvd.nist.gov/vuln/detail/cve-2026-109618

https://nvd.nist.gov/vuln/detail/cve-2026-109619 

Globality Response

On October 21, 2026, the PHP project disclosed two critical remote code execution vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, collectively referred to as "PHP2Shell." Globality has completed an assessment of the Glo 2.0 platform and its supporting services. We are sharing the results so you can update your third-party risk records.

Exposure status: Not affected

The Glo platform does not use PHP. Platform services are built on Python, JavaScript/TypeScript, and Java/Kotlin, and no application code, runtime, library, appliance, or supporting service that delivers the platform uses PHP. No PHP runtime is deployed in the platform environment.

Basis for this determination

Our assessment draws on two sources:Our documented service architecture and language inventoryThe software composition and container image scanning in our CI/CD pipeline, which checks dependencies for known vulnerabilities before deployment

Action required

None. No remediation, patching, or configuration change is required on the Glo platform, and no action is needed from your organization. Globality continues to monitor for emerging threats through continuous vulnerability scanning and our vulnerability management program, which is aligned with our SOC 2 Type 2 and ISO 27001:2022 certifications.

Please direct any questions to your Customer Success Manager or to the Globality Information Security team at infosec@globality.com.