In October 2026, the PHP project released fixes for two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. They affect web servers that run PHP versions earlier than 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What this means for Shinydrive
Shinydrive is not affected. Neither Shinydrive Server nor the Shinydrive Windows client includes or uses PHP.
What you should do
No action is needed for Shinydrive.
If other applications on your servers use PHP, follow their vendors’ guidance. The fixed PHP versions are listed in the PHP 8 changelog.
If you have any questions, contact Shinydocs Support.