Plotly’s Response to the Critical PHP Vulnerabilities (php2shell)

On October 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging organizations to immediately patch two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (commonly referred to as “php2shell”). These flaws allow unauthenticated remote code execution on PHP installations that serve web requests and affect a wide range of configurations, including Apache with mod_php (noted as highest risk), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

CISA later added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Systems running unsupported PHP 8.1 or earlier are advised to be taken offline until they can be updated or isolated.

Following disclosure of these vulnerabilities, Plotly conducted a comprehensive review of its products, infrastructure, and associated environments. The official findings are below.

Official statement

Following the recently disclosed PHP vulnerabilities, we have completed a comprehensive review of Plotly’s products, infrastructure, and associated environments to assess potential exposure.

Our analysis confirmed that PHP is not used within Dash Enterprise (DE) or any associated Plotly products or components. As such, these vulnerabilities do not impact our core products or customer deployments.

We did identify PHP within FileSender, an open-source utility used, where appropriate, to securely share files and data with customers. We immediately assessed the potential exposure and completed the necessary security due diligence, finding no evidence of compromise or unauthorized access. FileSender was also patched within one hour of the relevant security patch becoming available.

As an additional safeguard, FileSender operates with a 14-day data retention policy, after which shared files are automatically deleted. At the time the vulnerabilities were publicly disclosed, the only file present was a demonstration video containing no customer information or sensitive data.

Based on our investigation, the absence of PHP within our products, the prompt remediation of FileSender, and the lack of evidence of compromise or customer data exposure, we have identified no risk to Plotly customers arising from these PHP vulnerabilities.

We consider this matter assessed and remediated, with no further action required by our customers.

Key takeaways for customers

Core products unaffected: Dash Enterprise and other Plotly products and components do not use PHP. Customer deployments of these products are not exposed to php2shell.
Limited, non-product use of PHP: PHP was present only in FileSender, an open-source tool used selectively for secure file sharing with customers. It is not part of Dash Enterprise or the broader Plotly product stack.
Rapid response: The FileSender instance was assessed for exposure, checked for signs of compromise (none were found), and patched within one hour of the security update becoming available.
Data protection by design: FileSender’s 14-day automatic deletion policy limited residual data. At the time of public disclosure, the sole file present was a non-sensitive demonstration video with no customer information.
Conclusion: No risk to Plotly customers has been identified. No customer action is required related to these PHP vulnerabilities.

Wider context

php2shell stresses the importance of inventorying components—even those used only for supporting processes such as secure file transfer. Plotly’s review confirmed that its product architecture does not depend on PHP, and the isolated supporting use of the open-source FileSender utility was dealt with promptly with no evidence of impact.

This outcome is consistent with the security model of Dash Enterprise, Plotly’s platform for building, deploying, and governing production Python data applications. Dash Enterprise is designed as a highly secure, enterprise-grade environment for data apps. It maintains SOC 2 Type II compliance and holds ISO 27001, ISO 27701, and ISO 42001 certifications covering information security, privacy, and AI governance.

The platform builds governance and access control in, rather than leaving them to individual applications. Administrators can integrate with existing identity providers (via SAML, OpenID Connect, LDAP, and others through Keycloak) so that roles and groups are inherited automatically. Role-based permission control operates at the user, group, and individual app level, with clear distinctions between viewer, licensed user, and administrator permissions. Per-app viewer access can be set to Restricted (specific users and groups only), Authenticated, or Unauthenticated, and the platform enforces these controls before requests reach application code.

The App Manager provides a centralized interface for promoting applications throughout environments (such as Prototype, UAT, and Production), along with viewer analytics and audit logs. Platform middleware handles authentication and authorization, so teams don't need to embed authentication logic or secrets in their Python apps. Combined with support for self-hosted Kubernetes deployments (including air-gapped options), these capabilities give organizations strong control over who can access sensitive data applications and how those applications are managed throughout their lifecycle.

Plotly continues to monitor security advisories and maintains processes for rapid assessment and remediation of third-party components. Customers with questions about this issue or Plotly’s security practices may contact the security team via established channels.

This assessment is complete. No further customer action is required regarding the October 2026 critical PHP vulnerabilities.