Pushwoosh is not affected by PHP2Shell. Here’s why

In August 2026, Pushwoosh switched off its last PHP servers in production. 2 months later, on October 21, PHP shipped emergency patches for PHP2Shell, 2 critical vulnerabilities in its core (CVE-2026-109618 and CVE-2026-109619).

What PHP2Shell is

Both flaws let an attacker run code on a web server without logging in. They affect almost every PHP setup that serves web traffic, and exploitation is already being reported. That’s why security teams are now checking every vendor in their stack for PHP.

Why Pushwoosh is not affected

Our backend runs on Go, and nothing in our production runs PHP. We finished the migration on August 21, 2 months before PHP2Shell went public. We didn’t have to patch anything this week, because the vulnerable code was already gone.

Nothing changes on your side of the API

Every supported API endpoint works as before, and so do our SDKs and integrations. The migration changed what runs behind the API, not how you connect to it.

No action is needed from you as far as the Pushwoosh platform is concerned.

Check your own PHP stack

Our platform is safe, but some Pushwoosh integrations run on your servers, not ours. They’re PHP code, so they run on your PHP, and that PHP needs patching:

• The Pushwoosh WooCommerce plugin. The plugin itself isn’t vulnerable, but it runs on your WordPress site’s PHP.
• The Pushwoosh Magento module. Same story: it runs inside your Magento store, on your PHP.
• Custom backend code in PHP that calls the Pushwoosh API.

Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later. Updating WordPress, Magento, or plugins alone won’t help, because the flaw sits in PHP itself. PHP 8.1 and older get no official release with the fix, so if you’re still on one of those, upgrade or ask your OS/LTS vendor for a patched package. Fixed versions and interim mitigations are in the official PHP announcement.

Ask Pushwoosh about your security setup

If your security team needs a written confirmation for a vendor review, contact our support team or your account manager. Our SOC 2 Type 2 report and ISO 27001:2022 certificate are available on request too.