On Oct. 21, 2026, the PHP Group disclosed CVE-2026-109618 / 109619 (PHP2Shell), which allows affected versions of PHP to gain remote code execution capability. Grafana Labs is not affected by PHP2Shell, and Grafana Cloud and Grafana Enterprise contain no PHP.If you have additional questions regarding this CVE, please reach out to our customer support team.
PHP2Shell update (Oct. 23, 2026)
Grafana Labs not affected by PHP2Shell