Motadata ObserveOps and ServiceOps do not use PHP and are not affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619). This applies to both SaaS and on-premises deployments, and customers do not need to apply any patch or configuration change.
Are Motadata ObserveOps and ServiceOps affected by PHP2Shell? They are not, and we want to confirm that clearly.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the core PHP engine (CVSS up to 9.2). The PHP project fixed them on October 21, 2026. On servers running an unpatched version from PHP 5.4 onward, an attacker could run code without logging in or read server memory.
No PHP in any form: Neither ObserveOps nor ServiceOps uses PHP. We checked our application code, third-party dependencies, container images and deployment packages, and none of them contain a PHP runtime, interpreter, module or PHP-based component.
SaaS and on-premises: Both are covered by this assessment.
Reviewed by our security team: Our security team has reviewed our product stack and confirmed this assessment.
You do not need to apply any patch or configuration change to ObserveOps or ServiceOps.
Because PHP is widely used across web applications (for example WordPress, Drupal, Joomla and many internal tools), we recommend that your teams review other systems in your environment and apply the PHP security update released on October 21, 2026 wherever PHP is in use. Applying the official PHP patch is the only complete fix. Our PHP2Shell response guide explains how to find exposed servers, patch them and verify each fix.
If you have any questions or concerns about this vulnerability, or need a formal statement for your security, audit or compliance teams, please contact our support team at support@motadata.com. We will respond on priority.
We will continue to monitor this issue and will update this page promptly if anything changes.
Mindarray Systems is an IT operations software company headquartered in Ahmedabad, India. It builds Motadata, a powerful monitoring and management platform for the digital era, with cloud, on-premises, and hybrid deployment flexibility. The Motadata portfolio covers two products: ObserveOps for unified observability across metrics, logs, flows, traces, and topology, and ServiceOps for AI-enabled, ITIL 4 aligned service management.