Security Advisory: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Status: Resolved. All affected systems were patched on October 21, 2026. No customer action is required.
Summary
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as “PHP2Shell.” On web servers running unpatched PHP, these flaws can let an attacker run code without logging in.
LeadsOnline updated every affected system on October 21, 2026, the same day the updates came out. We then reviewed our logs and found no sign that anyone had exploited the flaws or gained unauthorized access.
Product impact
| Product | Uses PHP | Status |
|---|---|---|
| LeadsOnline | No | Not affected |
| NightHawk | No | Not affected |
| CellHawk | No | Not affected |
| Toolbox | Yes | Patched October 21, 2026 |
| leadsonline.com (company website) | Yes | Patched October 21, 2026 |
Frequently asked questions
- Do LeadsOnline products use PHP?
- LeadsOnline, NightHawk and CellHawk do not use PHP and were never affected. Toolbox and our company website use PHP and were patched.
- Has your environment been patched?
- Yes. All affected systems were updated to fixed PHP versions on October 21, 2026.
- Have you seen any sign of exploitation?
- No. After patching, we reviewed our logs and found no sign of exploitation or unauthorized access.
- Do customers need to update anything or put temporary safeguards in place?
- No. LeadsOnline hosts and manages the affected systems, so the fix has already been applied for every customer. There is nothing to install or configure.
- Will this advisory be updated?
- LeadsOnline is still watching vendor and government guidance on these vulnerabilities. If anything changes, we will update this advisory.
- Who can I contact with questions?
- LeadsOnline Support at support@leadsonline.com or 1-800-311-2656.