No. dotCMS doesn't run on PHP, so dotCMS Cloud and self-hosted dotCMS are not affected by CVE-2026-109618 or CVE-2026-109619.
What happened
On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both allow unauthenticated remote code execution. The flaws are in the PHP engine itself, not in any application built on it, so any server handling web requests with an unpatched PHP is exposed, no matter what code it runs. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA has asked organizations to patch immediately, and exploitation attempts have been reported.
Why dotCMS is not affected
The vulnerability lives in the PHP runtime, and dotCMS doesn't use it. The dotCMS server is a Java application running on Apache Tomcat, both in dotCMS Cloud and in self-hosted deployments. There is no PHP interpreter in dotCMS, so there is nothing for this exploit to reach.
If you use PHP with dotCMS
dotCMS offers a PHP SDK for teams that build their front end in PHP. The SDK is a client library: it runs inside your PHP application, on your servers, and talks to dotCMS through its APIs.
The SDK is not the vulnerable component, and no SDK update will fix this. Your PHP version is what matters.
If you run a PHP front end, with or without our SDK, upgrade PHP to a fixed version now or apply your OS vendor's patched packages. The SDK requires PHP 8.2 or later, and every one of those branches has a fix.
If you can't rule out that the server was reached before you patched, rotate the dotCMS API token your front end uses, and make sure that token belongs to a user with only the read permissions the front end needs.
What we're taking from this
This bug was in a language runtime, and every platform sits on one. Ours is Java and Tomcat, and they can have a bad week too. We're treating PHP2Shell as a drill for that day: how fast we can get a patched runtime onto every dotCMS Cloud environment, how fast self-hosted customers can get a fixed image, and how quickly we can tell you whether you're affected.
Questions about this or any other security issue: security@dotcms.com. We publish dotCMS security advisories at https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/known-security-issues.