On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities, known as PHP2Shell, that allow remote code execution on servers running PHP.
Appfarm is not affected. We do not use PHP anywhere in the Appfarm platform. This covers Appfarm Create, the runtime for your applications, our APIs, and our supporting services. Our services are built on Node.js and run on Google Cloud, and Google has confirmed that Google Cloud’s own infrastructure is not vulnerable.
After the disclosure, we reviewed our source code, container images and infrastructure configuration, and found no PHP in any production system. We have not found any signs that these vulnerabilities have been used against Appfarm, and no customer action is needed on the Appfarm platform.
We are also checking with our third-party suppliers and will contact you directly if anything they report affects the Appfarm service.
If your Appfarm applications connect to external systems that run PHP, such as your own websites or integration endpoints, we recommend checking with those system owners that they have applied the PHP security updates.