---
title: Meeting Room 365 not affected by the PHP2Shell vulnerability
meta_title: "Meeting Room 365 not affected by the PHP2Shell vulnerability"
slug: php2shell-meeting-room-365
excerpt: Meeting Room 365 doesn't use PHP in its core services. The isolated proxies that do were patched on October 21.
published: 2026-10-22T17:00:00.000Z
updated: 2026-10-22T17:00:00.000Z
tags: [security, exchange, ews]
feature_image: /blog/images/php2shell-meeting-room-365/php2shell-cve-2026-109618-github-advisory.1600.webp
feature_image_alt: GitHub security advisory for PHP vulnerability CVE-2026-109618
author: James Futhey
author_slug: james
meta_description: PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Meeting Room 365. We don't use PHP in core services, and our isolated PHP proxies were patched October 21.
status: published
---

On October 21 2026 PHP released fixes for two critical vulnerabilities, [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp), known together as PHP2Shell.

Meeting Room 365 doesn't use PHP in its core services. The display apps, the admin portal, and calendar sync for Microsoft 365 and Google Workspace all run on Node.js.

PHP runs in one place: isolated proxies that provide Exchange Web Services compatibility for older on-premises Exchange servers. We patched them on October 21, within hours of PHP's release. They now run PHP 8.4.27 and Ubuntu's fixed PHP 8.1 build.

Customers don't need to do anything. If your on-premises Exchange connection still uses the Proxy or Legacy proxy connection method, we do recommend upgrading it to Native, which connects to Exchange directly from our Node.js service. Change the connection method on your Exchange connection in the admin portal and press Test connection.