An update from Soundtrack on PHP2Shell
Vulnerabilities in PHP don't affect Soundtrack.
You may have read the news about major security flaws in PHP, but we have reassuring news for Soundtrack users: Soundtrack isn't affected by PHP2Shell. Your music keeps playing, and your account and data are safe. There's nothing you need to do.
What actually happened?
This week, security researchers found two serious flaws in PHP, which is a programming language used by many websites. Details of the flaws were made public on 20 October 2026. These two flaws could let attackers take control of the servers that run it.
PHP released fixes for the two security flaws on 21 October 2026.
How is Soundtrack affected by PHP2Shell?
At Soundtrack, we don't use PHP anywhere in our product or infrastructure and can confirm that as of 23 October 2026.
However, some of the partners that we work with may use PHP in their own systems. We're in touch with them directly and we'll update this article if anything changes for our customers.
How Soundtrack protects customers every day
Soundtrack runs on Google Cloud, which is independently audited against ISO 27001, SOC 2 and more. Independent security researchers test our web services, apps and hardware year-round through a public bug bounty with Intigriti.
All data is encrypted, both in transit and at rest.
A tip for your own business
Your website probably uses PHP: Wiz Research, who discovered the vulnerabilities, estimates that 70% of websites run on PHP.
Many of the most popular content management systems like WordPress rely on PHP. If your own website runs on PHP, check with your web provider that it's been updated.
Questions?
Contact your account manager or security@soundtrack.io. You can see Soundtrack's live service status at status.soundtrack.io. Our Security White Paper is available on request.
Fredrik Wärnsberg, Head of Technology at Soundtrack
Footnote: technical details
CVE-2026-109618 and CVE-2026-109619. PHP's developers rated both 9.2 (CVSS v4.0). Details leaked on 20 October 2026. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 5 and 7 have no official fix.
For more information, consult watchTowr's FAQ on the incident.
