PHP2Shell our customer response

On 20 October 2026, two critical remote code execution vulnerabilities in PHP, a widely used web programming language (CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”), were disclosed ahead of a planned fix. When we learned of them, the Bazaarvoice Security Team began assessing our exposure. Our core customer-facing platform services are not built on PHP and are not affected. We use PHP in a small number of supporting systems, and we have identified and assessed each of them. Remediation of these systems has begun. Depending on the system, that means applying PHP’s fixes, restricting access, or retiring the system, and we are starting with those that are reachable from the internet. We expect to complete this work as soon as possible.

We have also acted to protect our environment while remediation is completed. We have implemented rules on our network edge defenses, based on guidance from our security partners, and we are actively blocking traffic associated with attacks that use these vulnerabilities. We have completed a forensic investigation covering the period leading up to these measures and found no evidence that any attack was attempted or succeeded against Bazaarvoice systems, so we have no indication that any customer data has been accessed. We continue to monitor and will communicate any changes to the situation. No action is required from clients for our platform services. Clients who run PHP in their own environments, including environments that host Bazaarvoice integrations, should apply the official PHP fixes (versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later). For security questions, clients can reach out to security@bazaarvoice.comS'ouvre dans une nouvelle fenêtre.

What you need to do Official PHP security advisory

No action is required for Bazaarvoice platform services. If you run PHP in your own environments, including environments that host Bazaarvoice integrations, apply the official PHP fixes:

• 8.5.12 - 8.4.27 | 8.3.36 | 8.2.35 | or later

Frequently asked questions

1. What are the PHP2Shell vulnerabilities? CVE-2026-109618 and CVE-2026-109619 are two critical flaws in PHP, a programming language used by many web applications. They could allow an attacker to run commands on a server remotely. The flaws are in the PHP runtime itself, so any organization that runs PHP may be exposed until it applies the fixes.

2. Is any Bazaarvoice product or service affected? Our core customer-facing platform services are not built on PHP and are not affected. We use PHP in a small number of supporting systems. We have identified each of them, assessed our exposure, and begun remediation.

3. Has there been any exploitation or sign of compromise, and is my data safe? We have found no evidence of exploitation. We completed a forensic investigation covering the period leading up to our response and found no evidence that any attack was attempted or succeeded against Bazaarvoice systems. We therefore have no indication that any customer data has been accessed. We continue to monitor and will communicate any changes to the situation.

4. Has the issue been fixed? PHP released fixes on 21 October 2026. For the small number of supporting systems that use PHP, we have begun patching and expect to complete it within 48 hours, except for one system that requires a more extensive upgrade, which we expect to complete within 14 days. Until then, that system is hardened and protected by our network edge defenses. Where a system runs a PHP version that no longer receives fixes, we are upgrading, restricting, or retiring it instead of patching it.

5. What are you doing to protect against attacks while remediation is under way? We have implemented rules on our network edge defenses, based on guidance from our security partners, and we are actively blocking traffic associated with attacks that use these vulnerabilities. We are also monitoring for suspicious activity and prioritizing internet-facing systems for remediation. These protections run alongside patching, so systems remain protected while the remaining work is completed.

6. Which PHP versions are affected? The vulnerabilities are in the PHP runtime. PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Earlier releases of those branches are affected, as are older PHP versions (8.1 and earlier) that no longer receive security fixes. Organizations on those older versions should upgrade to a supported release. The official PHP security advisory is published at php.net/archive/2026.php#2026-10-21-5.

7. Is any action required on our side? No action is required for Bazaarvoice platform services. If you run PHP in your own environment, including an environment that hosts Bazaarvoice integrations, we recommend that you apply the PHP fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35, or later) or upgrade to a supported release, restart your PHP service or web server so the updated version loads, and review your own logs for unusual activity.

8. Do I need to update a Bazaarvoice SDK, plugin, or integration? No. The vulnerabilities are in PHP itself, not in Bazaarvoice code, so no update to a Bazaarvoice SDK, plugin, or integration is needed to address them. What matters is the PHP version in the environment where that code runs.

9. How will I hear about updates? We will communicate any changes to the situation and will contact you directly if we determine that you are impacted. Your Bazaarvoice account team can also relay questions to us.

10. Who can I reach out to if I have any additional questions about this situation? security@bazaarvoice.comS'ouvre dans une nouvelle fenêtre