October 22, 2026
On 20 October 2026, two critical remote code execution vulnerabilities in PHP, a widely used web programming language (CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”), were disclosed ahead of a planned fix. When we learned of them, the Bazaarvoice Security Team began assessing our exposure. Our core customer-facing platform services are not built on PHP and are not affected. We use PHP in a small number of supporting systems, and we have identified and assessed each of them. Remediation of these systems has begun. Depending on the system, that means applying PHP’s fixes, restricting access, or retiring the system, and we are starting with those that are reachable from the internet. We expect to complete this work as soon as
possible.
We have also acted to protect our environment while remediation is completed. We have implemented rules on our network edge defenses, based on guidance from our security partners, and we are actively blocking traffic associated with attacks that use these vulnerabilities. We have completed a forensic investigation covering the period leading up to these measures and found no evidence that any attack was attempted or succeeded against Bazaarvoice systems, so we have no indication that any customer data has been accessed. We continue to monitor and will communicate any changes to the situation. No action is required from clients for our platform services. Clients who run PHP in their own environments, including environments that host Bazaarvoice integrations, should apply the official PHP fixes (versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later). For security questions, clients can reach out to security@bazaarvoice.com.
What you need to do Official PHP security advisory
No action is required for Bazaarvoice platform services. If you run PHP in your own environments, including environments that host Bazaarvoice integrations, apply the official PHP fixes:
| 8.5.12 | 8.4.27 | 8.3.36 | 8.2.35 | or later |
Frequently asked questions
- What are the PHP2Shell vulnerabilities?
CVE-2026-109618 and CVE-2026-109619 are two critical flaws in PHP, a programming language used by
many web applications. They could allow an attacker to run commands on a server remotely. The flaws
are in the PHP runtime itself, so any organization that runs PHP may be exposed until it applies the fixes. - Is any Bazaarvoice product or service affected?
Our core customer-facing platform services are not built on PHP and are not affected. We use PHP in a
small number of supporting systems. We have identified each of them, assessed our exposure, and
begun remediation. - Has there been any exploitation or sign of compromise, and is my data safe?
We have found no evidence of exploitation. We completed a forensic investigation covering the period
leading up to our response and found no evidence that any attack was attempted or succeeded against
Bazaarvoice systems. We therefore have no indication that any customer data has been accessed. We
continue to monitor and will communicate any changes to the situation. - Has the issue been fixed?
PHP released fixes on 21 October 2026. For the small number of supporting systems that use PHP, we have
begun patching and expect to complete it within 48 hours, except for one system that requires a more
extensive upgrade, which we expect to complete within 14 days. Until then, that system is hardened and
protected by our network edge defenses. Where a system runs a PHP version that no longer receives fixes,
we are upgrading, restricting, or retiring it instead of patching it. - What are you doing to protect against attacks while remediation is under way?
We have implemented rules on our network edge defenses, based on guidance from our security
partners, and we are actively blocking traffic associated with attacks that use these vulnerabilities. We
are also monitoring for suspicious activity and prioritizing internet-facing systems for remediation. These
protections run alongside patching, so systems remain protected while the remaining work is completed. - Which PHP versions are affected?
The vulnerabilities are in the PHP runtime. PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Earlier releases of those branches are affected, as are older PHP versions (8.1 and earlier) that no longer
receive security fixes. Organizations on those older versions should upgrade to a supported release. The
official PHP security advisory is published at php.net/archive/2026.php#2026-10-21-5. - Is any action required on our side?
No action is required for Bazaarvoice platform services. If you run PHP in your own environment, including
an environment that hosts Bazaarvoice integrations, we recommend that you apply the PHP fixes (8.5.12,
8.4.27, 8.3.36, 8.2.35, or later) or upgrade to a supported release, restart your PHP service or web server so
the updated version loads, and review your own logs for unusual activity. - Do I need to update a Bazaarvoice SDK, plugin, or integration?
No. The vulnerabilities are in PHP itself, not in Bazaarvoice code, so no update to a Bazaarvoice SDK, plugin,
or integration is needed to address them. What matters is the PHP version in the environment where that
code runs. - How will I hear about updates?
We will communicate any changes to the situation and will contact you directly if we determine that you
are impacted. Your Bazaarvoice account team can also relay questions to us. - Who can I reach out to if I have any additional questions about this situation?
security@bazaarvoice.com
