We’ve received questions about the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Here is how they relate to Lightning Tools.
Lightning Tools products
Our products are SPFx based and do not contain PHP. These PHP vulnerabilities do not apply to the Lightning Tools product code, so no product patch is required for PHP2Shell.
Our website
Our public website is an informational site. Customers do not log in to it, and it does not host Lightning Tools products or customer environments. The site runs on WordPress and is hosted by SiteGround. SiteGround says it put server level mitigations in place before the PHP fixes were released, then applied the official fixes across its servers on 21 October 2026. SiteGround says no customer changes are needed.
HubSpot
We use HubSpot for CRM and customer support. HubSpot has stated that PHP is not part of its infrastructure and that it is not aware of any impact to its platform or customers. HubSpot says it will continue monitoring the situation.
We’ll update this notice if any of these providers publish information that changes this assessment.
References: SiteGround’s announcement · HubSpot Trust Center
