Skip to main content
AppianSupport
Employee
Nov 3, 2026 5:50 PM UTC

KB-2429 Information about CVE-2026-109618 and CVE-2026-109619 (also known as PHP2Shell), and CVE-2026-111943 (also known as eMudhra)

Following the 21-October-2026 announcement of the PHP unauthenticated remote code execution vulnerabilities (CVE-2026-109619 & CVE-2026-109618) and the eMudhra certificate authority weakness (CVE-2026-111943), Appian determined the following:

PHP: The impacted versions of PHP were being used on the Appian Cloud platform. On-premise versions of Appian were not impacted. 

eMudhra: Appian Cloud and On-premise versions of Appian were impacted. 

Appian is continuously conducting active security monitoring of Appian Cloud and is not aware of any breach or indicators of compromise related to these vulnerabilities, whether internal or external. 

Appian has taken the following actions in response: 

PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

  • Temporary Mitigation: Implemented a temporary WAF rule on Oct 21, 2026 (11:30 PM EDT) to block database direct access and the phpMyAdmin console across Appian Cloud while verifying EDR process protection coverage; EDR was announced by our provider on October 21st, 2pm EST and verified in subsequent communications on October 22.
  • Customer Communication: Issued customer notifications and opened emergency maintenance support cases.
  • Patch Development & Testing: Developed and validated hotfix releases (including updating PHP to patched versions such as 8.3.36 / 8.5.12).
  • Cloud & Internal Patching: Conducted mass patching across customer sites, and internal infrastructure.
  • WAF Reversion: Lifted the WAF database restriction following site patching

Timeline:

  • Oct 21, 2026: Critical PHP vulnerabilities announced; WAF block on database enacted at 11:30 PM EDT, in addition to EDR protections which actively blocked any potential exploit of the vulnerability.
  • Oct 22, 2026: Customer maintenance cases opened; PHP hotfixes validated and mass cloud restarts initiated.
  • Oct 23, 2026: Patching completed. WAF block reverted, restoring full database access across all commercial regions.

eMudhra Vulnerability (CVE-2026-111943)

  • Trust Store Remediation: Updated and overlaid CA certificate bundles to remove the compromised eMudhra intermediate CA across containers, client binaries, and microservices (e.g., aws-privateca-issuer, mountpoint-s3-csi-driver, Windows client).
  • Version Mapping: Identified target releases from 26.10 down to 24.4
  • Deployment: Released the eMudhra CA certificate fix to customers via the regular hotfix cycle.

Timeline:

  • Oct 21, 2026: eMudhra CA compromise identified; engineering teams initiated CA certificate package updates and trust store overlays.
  • Oct 27, 2026: eMudhra CA certificate remediation officially deployed as part of the standard hotfix cycle.

Affected Versions

This article applies to all supported versions of Appian.

Last Reviewed: November 3, 2026

    Terms & ConditionsAccessibility statement