Customer context: The customer wants to know if LiveAgent is affected by the PHP vulnerabilities known as "PHP2Shell", and whether any action is needed.
Customer: Is LiveAgent affected by the PHP2Shell vulnerability? Have you applied the patches?
Answer: The vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") are in PHP itself, which LiveAgent runs on. Fixed PHP versions were released on October 21, 2026, at 14:00 UTC. Within 15 minutes, we started actively monitoring our infrastructure for attack attempts, and we put interim mitigations in place while the update was being rolled out. All LiveAgent servers were fully updated to the fixed PHP version the same day, within four hours of the release. No action is required on your side.