PHP Vulnerability Responses by Company

Appwrite

Global cloud / infrastructure
Aliases / services
アップライト / Appwrite Functions / Appwrite
Official website
https://appwrite.io/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Appwrite Functions (PHP runtime)

Response status
Officially reported as not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides backend services and serverless functions.

Appwrite states that its Swoole-based PHP Functions are not affected by the two CVEs.

Scope: This is the vendor's assessment of the two CVEs, not an assurance about user code or a separate unserialize issue.

What users should do

Check custom functions for untrusted inputs to unserialize(); replace such use with JSON or another suitable format.

Official service URL

Source URLs

  1. https://appwrite.io/blog/post/php2shell-appwrite-not-affectedhttps://appwrite.io/blog/post/php2shell-appwrite-not-affectedResponse evidence
  2. https://appwrite.io/changeloghttps://appwrite.io/changelogService and operation documentation
  3. Appwrite Functions runtimeshttps://appwrite.io/products/functionsService and operation documentation

Appwrite Cloud (backend)

Response status
PHP updated; officially reported as not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Appwrite reports that Cloud's backend uses PHP 8.5.12 and that its Swoole architecture is not affected by the two CVEs.

Scope: Limited to the Appwrite-managed backend; not an assurance about external applications or custom code.

What users should do

No Cloud PHP update action is required. Review your own applications and custom functions separately.

Source URLs

  1. https://appwrite.io/blog/post/php2shell-appwrite-not-affectedhttps://appwrite.io/blog/post/php2shell-appwrite-not-affectedResponse evidence

Appwrite Self-hosted (backend)

Response status
PHP update available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Appwrite reports no impact from the two CVEs on its Swoole architecture. Releases 2.6.1/1.9.9 include PHP 8.5.12; subsequent security releases 2.6.2/1.9.10 were published on October 24.

Scope: Backend updates are distinct from checking PHP Functions and user code.

What users should do

Follow official instructions to update to the latest security release in your series. Review unserialize() usage in your own PHP code.

Source URLs

  1. https://appwrite.io/blog/post/php2shell-appwrite-not-affectedhttps://appwrite.io/blog/post/php2shell-appwrite-not-affectedResponse evidence
  2. https://appwrite.io/changeloghttps://appwrite.io/changelogResponse evidence
Related official sources
  1. Appwrite Functions runtimesOfficial information directory

Comments