Salesforce Sales Cloud and PHP2Shell

The statement

No public statement located as of 23 October 2026, 02:04 UTC at: https://status.salesforce.com/generalmessages/20000267; search:Salesforce PHP2Shell; https://security.salesforce.com/security-advisories (302 redirect to https://status.salesforce.com/, Trust Status app, needs JavaScript); https://status.salesforce.com/generalmessages/20000267 (Trust general message, page needs JavaScript); https://api.status.salesforce.com/v1/generalMessages/20000267 (the same general message as published data, read in full); https://www.softwareinsights.dev/posts/php2shell-php-rce-cve-2026-109618-109619-salesforce-impact/ (third party, CloudCounsel).

Notes

Salesforce's status page carries a general message dated 2026-10-21 (created 2026-10-21T20:12:34Z) saying it is aware of and actively monitoring the flaws and has no evidence of exploitation affecting Salesforce or customer data; it states no patched, affected or not affected status, so no status statement is recorded. Quoted from https://status.salesforce.com/generalmessages/20000267. Statement found but it states no fix, mitigation or affected status, so none of the fix statuses applies; recorded as no public statement located on fix status. Trust message Security Advisory: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619): At this time, we have no evidence of exploitation affecting Salesforce or customer data. and For additional context, please review the Official PHP Security Advisory. quoted from https://status.salesforce.com/generalmessages/20000267 (createdAt 2026-10-21T20:12:34Z). Reported by CloudCounsel (softwareinsights.dev) October 22, 2026, citing the same Trust notice.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

Salesforce Sales Cloud's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Salesforce Sales Cloud and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.