Blog
Avid Security Guidelines and Best Practices – PHP Remote Code Execution Vulnerabilities
Avid Knowledge Base
Avid have updated their Security Guidelines and Best Practices for Dealing with Virus Threats with an update on PHP.
October 23, 2026 Update
PHP Remote Code Execution Vulnerabilities
Avid has reviewed the two critical PHP remote code execution vulnerabilities disclosed this week and confirmed that Avid products are not affected. No Avid product uses the vulnerable PHP components, and no customer action is required in response to this disclosure.
What was disclosed
On October 21, 2026, the PHP project released emergency patches for two critical, unauthenticated remote code execution vulnerabilities after proof-of-concept details leaked ahead of the planned embargo:
|
CVE |
CVSS v4 |
Affected versions |
Impact |
|
CVE-2026-109618 |
9.2 |
PHP 5 and later |
Unauthenticated remote code execution |
|
CVE-2026-109619 |
9.2 |
PHP 5 and later |
Unauthenticated remote code execution |
Because PHP powers roughly 70% of websites with a known server-side language, these flaws (dubbed "PHP2Shell" by researchers) prompted broad concern across the industry this week.
Avid's Assessment
Avid's security team completed a review of CVE-2026-109618 and CVE-2026-109619 against Avid's product portfolio. That review confirmed Avid products do not rely on the affected PHP components and are not exposed to the vulnerabilities disclosed this week.
Recommended Action
No action is required by Avid customers in response to this disclosure. As always, Avid recommends keeping any third-party or self-hosted PHP applications in your own environment patched to the latest security releases.
CLICK HERE TO SEE THE COMPLETE KNOWLEDGE BASE ARTICLE
For further information, feel free to reach out to your Account Manager or our technical support team for assistance.
If you have any questions, please get in touch with the Altered Images team and we will be happy to advise.
