Nintex Security Advisory: PHP2Shell Vulnerabilities
(CVE-2026-109618 and CVE-2026-109619)
Published October 22, 2026 | Last updated October 22, 2026
Summary
Based on our investigation to date, we have found no evidence that Nintex products or services are affected by the PHP2Shell vulnerabilities, and no customer action is required for Nintex products or services.
Background
PHP2Shell refers to two recently disclosed critical vulnerabilities in the PHP programming language. Information about these vulnerabilities is still developing.
What we investigated
Our security team reviewed potential use of PHP in the Nintex ecosystem and products upon notification of the vulnerabilities. Our security operations team has also monitored for related activity and assessed our products and services for potential exposure to the affected components.
Our commitment
This situation is still developing. We will keep monitoring it, review new information as it becomes available, and update this advisory if our assessment changes. If any Nintex product or service is affected, we will notify affected customers directly.
Recommendation for your own environment
If your organization runs PHP, we encourage you to follow the guidance from the PHP project and CISA and update to a patched version.
Questions
Contact your Nintex account representative or Nintex.