On October 21, 2026, the PHP project released fixes for two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell.
Several customers have asked whether StatusGator is affected. The short answer is no. No StatusGator customer data is at risk from these vulnerabilities, and the StatusGator product does not use PHP.
The StatusGator product does not use any PHP
No part of the StatusGator application runs PHP. That includes the web application, dashboard, API, backend, file uploads, background processing, and monitoring infrastructure. Customer data is therefore not exposed to these vulnerabilities in any way.
Our blog runs on WordPress and has been patched
This blog is powered by WordPress which is built on PHP. It contains no customer data. It is hosted on a managed WordPress hosting provider, SiteGround, which confirmed that they mitigated the the vulnerabilities before the patch was released and then patched all customer instances on October 21, 2026.
While StatusGator was not affected, many providers took precautionary action. Read our analysis: More than 100 services acted on PHP2Shell before a patch existed.
Our status page previously ran on PHP
We operate our status page on separate infrastructure so that it will stay up during an outage of our own product. Previously, it ran on Cachet, a PHP-based open source status page. We had already planned to move it to a hosted provider, and we sped that up because of these vulnerabilities, completing the migration on October 21, 2026. The previous status page has been de-provisioned and never held any customer data.
We have found no signs of exploitation on any of these systems. Even if there had been, none of them has access to StatusGator customer data.
We know many of you run vendor reviews when advisories like this come out. We do the same with our own providers, and we want to make your review easy. If your security team has questions or needs anything for a vendor review, please contact us.
