Okta's Response to PHP2Shell

Okta is actively investigating the industry-wide third-party PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Cloud services: Not affected. Okta and Auth0 cloud service platforms are not affected by these vulnerabilities.

On-premise software: Remediation in progress. Okta Access Gateway, our on-premise product requires a patch. We are working through remediation measures.

We will continue to provide updates as available.