Microsoft Dynamics 365 and PHP2Shell

The statement

No public statement located as of 23 October 2026, 02:03 UTC at: https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623; search:Microsoft PHP2Shell; https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623 (Azure Network Security Blog post, body renders by script, only title and opening read); https://msrc.microsoft.com/blog/ (302 redirect to https://www.microsoft.com/en-us/msrc/blog, no PHP post); https://azure.status.microsoft/en-us/status/history/ (Azure status history, no entries dated 20 to 23 October 2026, no PHP mention).

Notes

Microsoft published a Tech Community post on PHP2Shell upgrade guidance and Azure WAF mitigations (page metadata modified 2026-10-22) at https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623; it is customer guidance for Azure workloads and says nothing specific to Dynamics 365, so no Dynamics 365 statement is recorded. The post body loads by script and was not read in full. Post titled Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations on Microsoft's Tech Community; readable opening: Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. quoted from the statement URL. Only the title and opening could be read (body loads by script), so the status rests on the title's own words (Azure WAF mitigations plus customer upgrade guidance) and should be rechecked in a full read. No date printed; page metadata modified_time 2026-10-22T10:26:20-07:00. Nothing found specific to Dynamics 365.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

Microsoft Dynamics 365's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Microsoft Dynamics 365 and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.