Skip to main content

Changelog

Updates, changes, and improvements at Retool.

Refer to the stable and edge release notes for detailed information about self-hosted releases.

CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

Summary​

  • PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is an upstream PHP vulnerability.
  • Retool is not affected. PHP does not run on anything internet-facing, nor does it run in our production environments.
  • No action required.

What Happened​

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a set of vulnerabilities in PHP. Retool became aware of them and opened an investigation on October 21, 2026.

Customer Guidance​

Retool is not affected, no customer action is required.

Impact​

PHP does not run on anything internet-facing, nor does it run in production or on anything connected to production. Retool is still reviewing third-party vendors for exposure and will update this page when we have completed our investigation.

Revision History​

  • 2026-10-21 — Initial publication.