Help Scout and PHP2Shell

On October 21, 2026 the PHP Foundation released a critical security update to address CVE-2026-109618 and CVE-2026-109619, two vulnerabilities that are collectively known as PHP2Shell. Help Scout applied the update to PHP as soon as it was available.  

We can confirm that this vulnerability was not exploited on our infrastructure.

We are still engaging with our sub-processors to understand how the services that we rely on may have been impacted. We will provide further updates if any new risk to our service is identified.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.