PHP Vulnerability Responses by Company

Okta

Global cloud / infrastructure
Aliases / services
Okta / Auth0 / Okta Access Gateway / okta.com
Official website
https://www.okta.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Okta Access Gateway

Response status
Fixed release available; upgrade required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Identity and access management.

OAG before 2026.44.0 is affected. The fixed 2026.44.0 release includes PHP 8.3.36.

Scope: On-premises OAG. Failure of public PoCs in the default configuration does not remove the upgrade requirement.

What users should do

Upgrade OAG to 2026.44.0 and follow the official verification guidance.

Official service URL

Source URLs

  1. https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619Response evidence
  2. PHP2Shell response and scopehttps://sec.okta.com/articles/2026/10/okta-response-to-php2shell/Response evidence
  3. https://support.auth0.com/center/s/article/php-critical-vulnerabilities-cve-2026-109618-and-cve-2026-109619https://support.auth0.com/center/s/article/php-critical-vulnerabilities-cve-2026-109618-and-cve-2026-109619Service and operation documentation

Okta cloud platform

Response status
Not affected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Okta states its cloud platform is not affected by these PHP vulnerabilities.

Scope: Only Okta cloud, not OAG or PHP runtimes executing customer SDK integrations.

What users should do

No action is needed for this cloud platform. Update your own PHP integration runtimes separately.

Source URLs

  1. https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619Response evidence
  2. PHP2Shell response and scopehttps://sec.okta.com/articles/2026/10/okta-response-to-php2shell/Response evidence
  3. https://support.auth0.com/center/s/article/php-critical-vulnerabilities-cve-2026-109618-and-cve-2026-109619https://support.auth0.com/center/s/article/php-critical-vulnerabilities-cve-2026-109618-and-cve-2026-109619Service and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice

Comments