PHP Vulnerability Responses by Company

Agora, Inc.

Global cloud / infrastructure
Aliases / services
Agora / Agora, Inc.
Official website
https://www.agora.io/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Agora server-side PHP token generation

Response status
Not listed
Response information checked
2026-10-28

Current re-audit: Official sources searched; no response found · Research date: 2026-10-28

The official AgoraIO Tools repository contains PHP dynamic key and token generation code for server-side integration.

Scope: These sources establish a customer-side PHP integration. Provider infrastructure impact or remediation for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) remains unverified. SDK availability or minimum PHP requirements are not proof of remediation.

What users should do

Keep the App Certificate off the browser and validate server-issued tokens scoped to the intended channel, user and expiration time.

Official service URL

Source URLs

  1. Agora: official PHP integration documentationhttps://github.com/AgoraIO/Tools/tree/master/DynamicKey/AgoraDynamicKey/phpService and operation documentation
  2. Agora: official operator and legal/company informationhttps://www.agora.io/en/terms-of-service/Service and operation documentation
Related official sources
  1. Agora: official PHP integration documentationOfficial information directory
  2. Agora: official operator and legal/company informationOfficial information directory

Comments