ThinkREG Is Not Affected by the php2shell Vulnerability

October 21, 2026

ThinkREG is not affected by php2shell, the critical PHP vulnerability disclosed on October 21, 2026. ThinkREG does not run PHP anywhere in its platform. Your event, registration and attendee data were never exposed to this flaw, and no action is needed on your part.

What php2shell is

php2shell is the name for two critical flaws in the PHP programming language, CVE-2026-109618 and CVE-2026-109619 (Fortune). They are rated 9.2 out of 10 and let an attacker run code on a server without logging in (ABC7).

The “70% of websites” headline refers to PHP’s reach, not to every website. PHP runs about 70% of sites whose server language can be identified, including WordPress, Drupal and Magento (Insurance Business). CISA and the FBI have urged anyone running PHP to patch immediately (ABC News). Sites that do not run PHP are not exposed.

Why ThinkREG is not affected

php2shell can only be exploited on servers that run PHP. ThinkREG’s platform is not built on PHP.

We reviewed our production configuration and confirmed that no PHP is installed or enabled anywhere a request can reach.

There is no path for this attack to reach ThinkREG.

Other safeguards already in place

Beyond avoiding PHP, the platform is hardened against the broader class of web attacks:

• All traffic is encrypted with HTTPS, and browsers are instructed never to connect over an insecure channel.
• Standard browser security protections are applied to every page.
• Server features commonly abused in attacks, such as running scripts directly on the web server, are disabled.
• Protections against denial-of-service traffic are in place.
• Our public web pages are static and contain no server-side code.

What this means for you

There is nothing you need to do for ThinkREG. Registration, check-in, badge printing and attendee apps continue to run normally.

If your organization runs its own website on WordPress or another PHP-based system, check with your web team or host that PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (Insurance Business). If you have questions, please feel free to reach out to your ThinkREG account representative.

References

• CNN coverage of the php2shell vulnerability — CNN, October 21, 2026
• AI tools discovered the PHP vulnerability that could take down 70% of the Internet — Fortune, October 21, 2026
• Urgent security fix issued for code vital to estimated 70% of all websites — ABC News, October 21, 2026
• Critical global website flaw sparks alerts across Asia-Pac as attacks begin — Insurance Business, October 22, 2026