Carousel Cloud and PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Carousel Cloud is not affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Carousel Cloud does not use PHP in any part of the product, so there is nothing for you to update or change.

This applies to the Carousel Cloud web application, the Carousel Cloud servers that host your account, and every Carousel Cloud player application.

What Should You Do?

You do not need to do anything for Carousel Cloud. Your Carousel Cloud account, players, content, need no updates, restarts, or setting changes.

Other systems on your network may still use PHP, such as your organization's website or intranet. We recommend asking your IT team to check those systems and apply the PHP updates listed above.

We watch for security advisories that could affect Carousel Cloud and the services it relies on. If a future issue does affect Carousel Cloud, we will contact affected customers directly.

Why Carousel Cloud is Not Affected

Carousel Cloud is not affected because no part of it is built on PHP or runs PHP. Our engineering team reviewed every Carousel Cloud component and found no PHP code and no PHP runtime.

Because PHP is not present, the vulnerable code cannot be reached on any Carousel Cloud system.

About the Vulnerability

PHP2Shell is the name for two critical flaws in PHP, a programming language that many websites and web applications run on. PHP published fixes on October 21, 2026. Both flaws can let an attacker run commands on a web server running PHP without logging in.

The flaws only affect systems that run PHP. Websites built on PHP-based platforms, such as WordPress, Drupal, Joomla, and Magento, are the most common targets.

Related Links

• Tenable: php2shell FAQ

• UK NCSC: Critical security issue affecting PHP

If you have additional questions, please submit a support ticket using the Submit a request link below.