PHP security vulnerabilities: Shorthand unaffected

Incident Report for Shorthand

Resolved

This incident has been resolved.
Posted Oct 26, 2026 - 15:08 UTC

Monitoring

We’re aware of the two critical PHP vulnerabilities disclosed this week, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”.

The Shorthand platform is not affected. Our editor, API, story hosting and publishing infrastructure don’t use PHP. No action is needed for stories published on Shorthand or hosted through Shorthand.

If you use WordPress or Drupal: our plugins run on your own server, which uses PHP. The plugin itself doesn’t introduce these vulnerabilities, but your server’s PHP version may be affected. Please check with your hosting provider or IT team to make sure your servers are running a patched PHP release.

We’ll continue to monitor this and update this notice if anything changes. If you have any questions, please contact our support team at help@shorthand.com
Posted Oct 26, 2026 - 09:44 UTC
← Current Status Powered by Atlassian Statuspage