Status: Informational. Not affected; no action required.
We are aware of the recently disclosed critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as “PHP2SHELL”, and of the related security advisories published by government cybersecurity agencies.
Our Security team has reviewed these vulnerabilities and confirmed that GoodData does not use PHP anywhere in its products or infrastructure. As a result, GoodData Cloud, GoodData.CN and GoodData Legacy are not affected. No patches or mitigations are required, and no action is needed from customers.
We continuously monitor new vulnerabilities, and if anything changes, we will update this article.
If you have any questions, please contact us at support@gooddata.com.
Updates