Overview
PHP2Shell refers to two vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. The PHP development team reports that the vulnerabilities could allow unauthenticated remote code execution in affected PHP environments. (PHP security release)
Gurobi product impact
Gurobi products are not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The vulnerabilities are in the PHP runtime and do not affect Gurobi Optimizer or Gurobi Remote Services.
What customers should do
No action is required for Gurobi products in response to these vulnerabilities. If your environment also runs PHP - for example, in a custom application or a third-party service - assess and update that PHP environment according to the PHP security advisory.
For questions about your Gurobi deployment, contact Gurobi Support.