Security Notice: Locus Software Products Not Affected by PHP2Shell Vulnerabilities

MOUNTAIN VIEW, Calif., October 22, 2026 —Locus Technologies’ software products do not use PHP and are not affected by the recently disclosed PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, commonly called “PHP2Shell.” 

No patches, configuration changes, or other customer actions are required for Locus products in response to these vulnerabilities. Customers can continue using their Locus applications as usual. 

About the vulnerabilities 

The vulnerabilities affect PHP installations that process web requests and can allow attackers to execute code remotely without authentication. The third-party PHP project released security updates on October 21, 2026.

This notice addresses Locus software products only. Customers should assess any separate PHP-based systems or third-party applications within their own environments independently. 

Questions 

Customers and their IT or security teams can contact their Locus representative or usual Locus support contact with questions about this notice.