What is PHP2Shell? Is ServiceNow affected?

October 22, 2026 | Cybersecurity · ServiceNow · PHP

The internet world has been talking about a major security vulnerability in recent days. Two quite serious security vulnerabilities have been discovered in the PHP programming language, which is widely used in developing websites and online applications.

These vulnerabilities, called PHP2Shell, allow attackers to interfere with some servers without knowing a username or password.

So, is ServiceNow, used in many areas from business processes to IT service management, also affected by this? Does ServiceNow use PHP? Is there any reason for users to worry?

We have gathered the information we can verify for now by reviewing official statements and published security advisories.

What is PHP2Shell, and why is it so important?

PHP is a popular programming language that powers websites behind the scenes. It has a very wide range of uses, from content management systems like WordPress to enterprise web applications.

On October 20, 2026, the PHP development team announced that it had prepared an emergency update for two critical security vulnerabilities. On October 21, the technical details of the vulnerabilities and security patches were published.

The vulnerabilities are tracked under the following numbers:

• CVE-2026-109618
• CVE-2026-109619

The severity of both security vulnerabilities was announced as 9.2 out of 10 according to the CVSS 4.0 assessment. This means a critical-level security risk.

So, what does this mean?

Normally, you need to have certain permissions to perform operations in a web application. However, on some PHP servers affected by these vulnerabilities, attackers can run malicious code on the server without logging in.

A successful attack can lead to access to sensitive information on the server, data theft, or loss of control over the web service.

Moreover, the problem does not stem from the software of a particular website, but directly from PHP’s execution mechanism. Therefore, it may not be enough for applications that use PHP to rely solely on their own security controls.

Source: PHP Security Team – October 21, 2026 Official Security Advisory

So, does ServiceNow use PHP?

Let’s get to the question many ServiceNow users are curious about.

ServiceNow is a cloud-based platform that helps organizations manage their IT services, workflows, and various operational processes.

When we look at ServiceNow’s official technical documentation, we see that the application development and automation structure on the platform primarily uses JavaScript.

For example, JavaScript is used in server-side development components such as Business Rule and Script Include on ServiceNow. ServiceNow’s own technical support team also states in its published documentation that server-side coding uses JavaScript almost exclusively.

This is important information. Because PHP2Shell is a security vulnerability detected in PHP’s runtime environment, not in JavaScript.

However, there is a detail to pay attention to here.

The fact that ServiceNow’s core scripting structure uses JavaScript does not definitively prove that there are no PHP components in all the infrastructure or auxiliary services managed by the company.

Therefore, it would not be correct to say, based only on the technology architecture, that ServiceNow is definitely not affected by these security vulnerabilities.

Sources: ServiceNow – Scripting Documentation · Server-side Coding Best Practices

Has ServiceNow made a statement about the security vulnerability?

Yes. A comprehensive technical article about PHP2Shell was published on ServiceNow’s own Community platform.

The article titled “PHP2Shell: How to find, prioritize, and patch affected systems” was prepared by Michael Freeman (Head of Threat Intelligence) and Guy Broder (Sr. Director, Product Management).

The article explains how the vulnerabilities work, which PHP systems are at risk, how those systems can be detected, and which measures should be taken.

It also shares queries for detecting affected PHP versions for customers using ServiceNow’s Armis security solution.

This shows that the ServiceNow ecosystem provides technical guidance on this security threat.

However, there is an important distinction: the published content is about threat detection and security measures through Armis. It is not a product security advisory directly explaining whether ServiceNow’s own Now Platform infrastructure is affected by PHP2Shell.

Therefore, this article should not be treated as a statement that all ServiceNow products are secure.

Source: ServiceNow / Armis – PHP2Shell Security Analysis

What is the real risk for ServiceNow users?

Here, we need to distinguish between two different situations.

The first is organizations that directly use ServiceNow’s cloud service.

ServiceNow’s published application development documentation shows that standard server-side scripts are JavaScript-based. However, in the publicly available sources we were able to review, we could not find a vendor statement clearly confirming whether the Now Platform is affected by these two CVEs.

Therefore, we do not have enough evidence to claim that ServiceNow’s cloud service is affected by these vulnerabilities.

The second is other systems that work in connection with ServiceNow.

Organizations can integrate ServiceNow with different web applications, internal services, and third-party systems.

If one of these external systems uses PHP and runs a version affected by the vulnerability, the relevant system needs to be evaluated separately.

Here, the source of the risk does not have to be ServiceNow itself. Another connected application may also require a security review.

In short, organizations using ServiceNow need to consider not only the main platform but also the applications connected to it.

What measures have been taken for the vulnerability?

The PHP development team released security updates fixing critical vulnerabilities on October 21, 2026.

The PHP versions that include the update are as follows:

PHP 8.1 and earlier versions are no longer covered by the PHP project’s normal security support. Systems using these versions need to move to a supported version or obtain a security fix from the relevant distribution provider.

ServiceNow’s Armis team also recommends that organizations identify their systems that use PHP, apply security patches, and isolate systems that cannot be updated when necessary.

On the other hand, security service providers such as Cloudflare have also announced that they have implemented additional protections against attack attempts.

However, such protections have an important limitation: a firewall or additional protective measures do not replace the security update that must be applied to PHP itself.

Sources: PHP – Official Security Update · NHS England – Critical Vulnerabilities in PHP · ServiceNow / Armis – Protection and Detection Guide

What should organizations and users do?

It is not realistic to expect every user to perform a technical security analysis. However, organizations’ IT and information security teams can provide clear answers to a few fundamental questions.

First, check whether your organization has any websites or applications that use PHP. If it does, verify whether the versions in use are up to date.

Internet-facing services should be prioritized for assessment.

Organizations using ServiceNow should include third-party applications connected to the platform, integration services, and servers they manage themselves in their security inventory.

For definitive information about the infrastructure managed by ServiceNow, the most reliable approach will be to request an official impact assessment directly from the vendor.

These checks help organizations prepare not only for PHP2Shell but also for similar vulnerabilities that may emerge in the future.

Conclusion: Should ServiceNow users be worried?

The information we have been able to verify so far shows three important points.

First, PHP2Shell is a real and critical security threat. The PHP development team has confirmed the vulnerabilities and released security updates.

Second, ServiceNow’s standard application development infrastructure is not documented as PHP-based. The platform’s official development documentation confirms the use of JavaScript.

Third, we have not found a comprehensive official statement confirming that all of ServiceNow’s products and services are unaffected by these vulnerabilities.

This last point is important. The absence of evidence that a vulnerability has been exploited is not the same as the vendor confirming that it has not been exploited.

Therefore, with the current information, it would not be correct to claim a definitive security breach or direct impact for ServiceNow users.

The right thing to do is to follow verified vendor statements and check the security status of connected systems that use PHP.

Because in cybersecurity, being able to correctly assess unconfirmed information is as important as having accurate information.

Sources and official statements

This article was prepared based on vendor announcements and official technical documents available as of October 22, 2026.

• PHP Security Team – October 21, 2026 Critical Security Advisory
• ServiceNow – Official Scripting Documentation
• ServiceNow Technical Support – Server-side Coding Best Practices
• ServiceNow / Armis – PHP2Shell: How to Find, Prioritize, and Patch Affected Systems
• NHS England – Critical Vulnerabilities in PHP (PHP2Shell)
• Canadian Centre for Cyber Security – Critical Vulnerabilities Impacting PHP

Editor’s note: Information about security vulnerabilities may change with new announcements. Since ServiceNow’s impact status on the Now Platform cannot be confirmed using publicly available sources, this article does not replace official vendor confirmation on the matter.