Okta's Response to PHP2Shell
On October 21, 2026, industry-wide third-party critical PHP pre-authentication remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, both with CVSS scores of 9.2.
Okta tested the publicly available proof-of-concept (PoC) exploits against Okta Access Gateway in its default configuration, and none achieved code execution.
Okta’s Response
Cloud services: Not affected. Okta and Auth0 cloud service platforms are not affected by these vulnerabilities.
On-premise software: Okta Access Gateway (OAG) requires a patch. Customers should upgrade to Okta Access Gateway version 2026.44.0.
Action for Okta Access Gateway (OAG) Customers
Customers running Okta Access Gateway appliance versions prior to 2026.44.0 should upgrade to version 2026.44.0. For complete vulnerability details and remediation guidance, refer to the Security Advisory:
Action for Auth0 and Okta SDKs users
For actions required and developer guidance, please refer to the appropriate KnowledgeBase article: