VisualSVN products are not affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

We confirm that VisualSVN products are NOT AFFECTED by two recently disclosed vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. In other words, the products require no action regarding PHP2Shell.

Vulnerability information

CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP. Information about the vulnerabilities became publicly available on October 20, 2026. At the time of writing, the vulnerability is known to be actively exploited in the wild.

VisualSVN Server is not affected

VisualSVN Server and its components do not include or use PHP in any form. So VisualSVN Server is NOT AFFECTED by the CVE-2026-109618 and CVE-2026-109619 vulnerabilities (PHP2Shell).

VisualSVN for Visual Studio is not affected

VisualSVN for Visual Studio and its components do not include or use PHP in any form. So VisualSVN for Visual Studio is NOT AFFECTED by the CVE-2026-109618 and CVE-2026-109619 vulnerabilities (PHP2Shell).