On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities in the PHP interpreter, known together as “PHP2Shell.” Both are rated 9.2 (CVSS v4.0) and could let an unauthenticated attacker run code remotely on an affected web server. Details of the flaws leaked publicly on 20 October, before the patches were available, so organizations everywhere have been treating this as urgent.
Are Jscrambler products affected?
No. None of our products use PHP, so they are not exposed to these vulnerabilities. Customers don’t need to do anything with respect to Jscrambler products.
What about Jscrambler’s internal systems?
A small number of our internal systems use PHP. Our team updated these systems as soon as the vulnerabilities were announced. By 22 Oct, every one of them had been updated to a patched PHP release.
Need more information? If you have questions, contact us at [email protected].