# CVE-2026-109618

Impacts of vulnerabilities in PHP component (CVE-2026-109618/CVE-2026-109619 | PHP2Shell)

**Published**
2026-10-29

**Updated**
-

**Description**
Dassault Systèmes is aware of the critical PHP vulnerabilities identified as CVE‑2026‑109618 and CVE‑2026‑109619 (PHP2Shell). Since Wednesday, 21 October 2026, our Cybersecurity team, operating under our NIST-based vulnerability management program, has been actively investigating any potential impact on our solutions.

Up-to-date details for all Dassault Systèmes products are available in a dedicated Support [KB article](https://support.3ds.com/knowledge-base/?q=docid:QA00000518890)

As of now, among all Dassault Systèmes products, these vulnerabilities have been identified to affect Tuleap Enterprise Edition 17.5, [access remediation information](https://my.enalean.com/plugins/document/tuleap-by-enalean/folder/3616/3720) for this product.

**Affected Products**
Tuleap Enterprise Edition

**Affected Versions**
17.5

**Severity**
Critical

## Go to Dassault Systèmes Security Advisories

[Security Advisories](/trust-center/security/security-advisories)

[   Go to CVE record     ](https://www.cve.org/CVERecord?id=CVE-2026-109618)

[   Access remediation information  ](https://my.enalean.com/plugins/document/tuleap-by-enalean/folder/3616/3720)