Cisco engineering continues to roll out and validate a remediation for the impact on SWG traffic caused by a third-party certificate issue across Cisco Umbrella and Cisco Secure Connect.
We're aware of the PHP vulnerabilities, have mitigations in place, and are actively patching our services, including Web Hosting, Managed Hosting for WordPress, etc.. If you manage your own server or VPS, you'll need to apply the PHP update yourself. Latest updates and steps can be found at https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do
Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.
Monitors
Great Minds Affirm
[Cisco Umbrella & Cisco Secure Connect] Secure Web Gateway Degradation
Cisco Umbrella
Shakopee Infinite Campus