Build for free
  • Nylas
  • Blog
  • Security
  • Nylas Update on PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Nylas logo with the text

Nylas Update on PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

• 1 min read
Jump to section
Author: Kirthana Ramesh Selvam
Kirthana Ramesh Selvam
Tags:
Jump to section

Published October 23, 2026

Nylas services are not affected by PHP2Shell.

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities in the PHP runtime, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can allow unauthenticated remote code execution on servers that run unpatched PHP.

What this means for Nylas customers

  • The Nylas API and the services that store, process or access customer data don’t use PHP.
  • Our only PHP-based system is our public marketing website. It’s hosted separately from our production platform and doesn’t store, process or access customer data. It has been upgraded to PHP 8.5.12, a patched release.
  • We have found no evidence of exploitation of these vulnerabilities and no unauthorized access to customer data.
  • No action is required on your side.

What we’re doing

We’re assessing exposure with our critical suppliers as part of our vendor risk management process. We’ll update this post and our Trust Center if anything changes.

More information

Related resources

Padlock illustration next to the title
Engineering Security
How to get an OpenClaw or Hermes agent approved by your security team

I’ve found that when anyone responsible for security hears “OpenClaw” or “Hermes,” they almost have…

• 11 min read
Read more
Security
European data residency for calendar APIs: how to evaluate vendors

Calendar API evaluations in Europe can go wrong at the first step, and it is…

• 6 min read
Read more
Security
What it actually takes to migrate a scheduling integration

Vendors describe migrations as straightforward. Engineering teams who have run one describe them differently. The…

• 6 min read
Read more