An Alliants statement to confirm that our platform is not impacted, following the recent disclosure of two critical remote code execution vulnerabilities in PHP runtime.

Following the disclosure of two critical remote code execution vulnerabilities in the PHP runtime ("PHP2Shell", CVE-2026-109618 and CVE-2026-109619, published 21 October 2026), we have completed an assessment of the Alliants Experience Platform (AXP), including the current alliants.ai platform and the original AXP (alliants.app) platform.

Summary: Alliants is not affected.

Neither platform is built on PHP. Our services use Node.js/TypeScript and Ruby, and the PHP runtime is not part of our application code or the container images we deploy.

We have reviewed the cloud hosting environment for AXP and found no PHP runtimes serving web traffic.

No customer action is required.

As part of our standard vulnerability management process we continue to monitor vendor advisories and threat intelligence. We have also applied additional web application firewall protections against attempts to exploit these vulnerabilities. We will contact you if our assessment changes.

If you have any questions, please contact your Customer Success Manager or Alliants point of contact.