Digication is not affected by the PHP "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Dear Digication Administrators,

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities that can let an attacker run code on a server running PHP without signing in.

Digication is not affected. Our engineering team reviewed our code and our cloud environments, and the Digication platform does not run PHP. Older Digication web addresses that end in ".php", such as some single sign-on links, are answered by our current services, which do not use PHP.

We are also confirming the status of the third-party services we rely on.

If your organization runs PHP-based software, such as Moodle, we recommend applying the PHP updates (versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later) as soon as possible. We are contacting organizations that connect Moodle to Digication directly.

If you have any questions, please reach out to our support team at support@digication.com.

Kind regards,
Your friends at Digication