Salesforce Sales Cloud and PHP2Shell

Is this your company?

Publish or update your statement. The statement submission is free.

See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.

We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.

Agencies: white-label PHP2Shell Record Check, $490 per client report.

The statement

No public statement located as of 23 October 2026, 02:04 UTC at: https://status.salesforce.com/generalmessages/20000267; search:Salesforce PHP2Shell; https://security.salesforce.com/security-advisories (302 redirect to https://status.salesforce.com/, Trust Status app, needs JavaScript); https://status.salesforce.com/generalmessages/20000267 (Trust general message, page needs JavaScript); https://api.status.salesforce.com/v1/generalMessages/20000267 (the same general message as published data, read in full); https://www.softwareinsights.dev/posts/php2shell-php-rce-cve-2026-109618-109619-salesforce-impact/ (third party, CloudCounsel).

Notes

Salesforce's status page carries a general message dated 2026-10-21 (created 2026-10-21T20:12:34Z) saying it is aware of and actively monitoring the flaws and has no evidence of exploitation affecting Salesforce or customer data; it states no patched, affected or not affected status, so no status statement is recorded. Quoted from https://status.salesforce.com/generalmessages/20000267. Statement found but it states no fix, mitigation or affected status, so none of the fix statuses applies; recorded as no public statement located on fix status. Trust message Security Advisory: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619): At this time, we have no evidence of exploitation affecting Salesforce or customer data. and For additional context, please review the Official PHP Security Advisory. quoted from https://status.salesforce.com/generalmessages/20000267 (createdAt 2026-10-21T20:12:34Z). Reported by CloudCounsel (softwareinsights.dev) October 22, 2026, citing the same Trust notice. 23 October source review: the official public Trust API still states awareness and no evidence of exploitation, without a fixed, mitigation or affected status. No fix-status upgrade inferred.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

Questions about Salesforce Sales Cloud and PHP2Shell

Is Salesforce Sales Cloud affected by PHP2Shell?

No public statement located for Salesforce Sales Cloud as of 23 October 2026, 02:04 UTC; places checked: https://status.salesforce.com/generalmessages/20000267; search:Salesforce PHP2Shell; https://security.salesforce.com/security-advisories (302 redirect to https://status.salesforce.com/, Trust Status app, needs JavaScript); https://status.salesforce.com/generalmessages/20000267 (Trust general message, page needs JavaScript); https://api.status.salesforce.com/v1/generalMessages/20000267 (the same general message as published data, read in full); https://www.softwareinsights.dev/posts/php2shell-php-rce-cve-2026-109618-109619-salesforce-impact/ (third party, CloudCounsel).

The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.