On October 21, 2026, the PHP project disclosed two critical vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell").
PHP is not used in the Testsigma platform, including the application, APIs, and test execution infrastructure. At Testsigma, PHP is limited to the content management system behind our public blog.
We have upgraded the PHP runtime for the blog to version 8.2.35, the patched release that fixes both vulnerabilities, and confirmed the fix is in place. We also reviewed activity on the blog infrastructure since October 17, 2026 and found no evidence of compromise.
The Testsigma platform and customer data were not affected, and no action is required from customers.