CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) are two remote code execution (RCE) exploits found within the (Hypertext Preprocessor) PHP language. The Mendix platform does not use PHP, and as such is not impacted by these vulnerabilities. Mendix applications and data are safe. Any custom PHP extension, plug-in, or scripting should be reviewed by its respective owner and updated following PHP guidelines.