PHP2Shell: Tandem Health is not affected
Av
Tandem Health
·
·
Security update
On 21 October 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. The flaws can let an attacker run code on a server that runs PHP, without logging in.
Our status
Tandem Health is not affected. There is no PHP in our production environment.
How we checked
We ran an inventory check of our production stack. It covered our third-party services as well as our own systems, so we could confirm the result for the whole environment.
What this means for customers
Nothing. No action is needed from our customers or partners.
If you have questions, contact our security team at security@tandemhealth.ai.
