This week, two critical vulnerabilities in the PHP programming language were publicly disclosed. They are tracked as CVE-2026-109618 and CVE-2026-109619 and are being referred to as “PHP2Shell”. The flaws can allow attackers to run code remotely on servers running affected versions of PHP.

No web-application developed / hosted by Amtac is affected.

Our hosting platform does not use PHP. No part of the infrastructure that runs customer applications and stores customer data relies on the PHP runtime. This includes our application servers, control panel, APIs and databases. 

After the disclosure, our security team reviewed our environment and confirmed that none of our web-applications are exposed to these vulnerabilities.

Do customers need to do anything?

No action is needed. Your applications and data are not exposed to these vulnerabilities through our platform.

Our ongoing commitment

We monitor security disclosures continuously and assess every significant vulnerability against our platform. If anything changes, we will update this page.

If you have questions, please contact our support team at support@QR2id.com.