Instructure identified two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, "PHP2Shell") affecting some of their products. Canvas itself was unaffected as it does not use PHP, but other Instructure products running vulnerable PHP versions were identified as at risk. Compensating controls and additional monitoring were implemented while remediation work was prioritized, with the situation stabilized within 53 minutes.
We are continuing to monitor for any further issues.
Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with