On October 21, 2026, the PHP Group released an emergency security update for two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to publicly as "PHP2Shell." U.S. and European agencies recommended that organizations review deployed PHP systems and apply patches as necessary to protect against exploits to vulnerable systems.

Following our standard vulnerability monitoring policy, we reviewed the advisories and confirmed that neither Articulate 360 AI nor the infrastructure supporting our products uses PHP. This includes our hosting platform, application libraries, and internal tooling. These vulnerabilities do not affect Articulate products or customer data.

We did determine that our marketing website (www.articulate.com) and our blog (blogs.articulate.com) run on a content management system that uses PHP. A third-party provider hosts these sites separately from our product infrastructure. They don't store or process customer data and have no connection to our product environment.

As of October 22, 2026, both our marketing website and our blog are running the patched PHP release. Remediation is complete, and no action is needed from customers.

No customer data was affected, and customers do not have to take action as a result of this vulnerability.

We take security seriously at Articulate. If you have any questions, contact us at security@articulate.com. For more information about our security efforts, visit our Trust Center.