On October 21, 2026, two critical vulnerabilities in the PHP programming language were publicly disclosed. They are tracked as CVE-2026-109618 and CVE-2026-109619 and are known together as "PHP2Shell." Both are rated critical because they could let an attacker run code on an affected web server without logging in. Nearly every version of PHP in use today is affected, so many institutions are reviewing their vendors' exposure this week. Here is where Qwickly stands.

Qwickly products are not affected

Qwickly's products are not built on PHP, so these vulnerabilities do not apply to them. This includes:

• Qwickly Attendance (Classic, Plus, and Pro)
• Qwickly Course Tools
• Qwickly Jot
• The qwickly.tools Administrative Dashboard

No action is required from administrators, instructors, or students, and your Qwickly integrations with your learning management system do not need to be changed.

Our public website

Qwickly's public marketing website, goqwickly.com, does use PHP. It is hosted separately from our products and does not store any client or student data. Our team responded the same day the vulnerabilities were disclosed: we applied an interim safeguard right away and installed the patched release of PHP as soon as it was available. The website is fully patched.

Questions

If your IT or security team needs more detail for a vendor review, please submit a support ticket and our team will follow up directly.