On October 21, 2026, two critical remote code execution vulnerabilities in PHP were disclosed, known as “php2shell” (CVE-2026-109618 and CVE-2026-109619). The only TitanFile system they affected was our corporate website. We put mitigating measures in place immediately and then applied the PHP security patch.
The TitanFile platform and all services that host or process customer data run on separate infrastructure. They do not use PHP and were not affected.
Our security program is certified to ISO 27001 and audited to SOC 2 Type 2, and we continue to monitor our environment. Customers with questions can contact support at https://support.titanfile.com/.