Okta has released a security advisory addressing the industry-wide “PHP2Shell” vulnerabilities affecting third-party PHP components, tracked as CVE-2026-109618 and CVE-2026-109619. The post outlines how the identity provider assessed its exposure and what steps it took in response to the flaws.
Because Okta is a central identity and access management provider, any vulnerability touching its infrastructure carries outsized risk for downstream organizations that rely on it for authentication and single sign-on. PHP-based flaws that could enable code execution are particularly concerning when they sit near identity systems that broker credentials and session tokens.
What to take away: Organizations using Okta should review the advisory to confirm whether any action is required on their side, and more broadly audit their own exposure to the underlying PHP vulnerabilities across identity-adjacent services.