Trust & Compliance Center

Security Advisory: PHP Vulnerabilities (PHP2Shell, CVE-2026-109618 and CVE-2026-109619)

Published: October 21, 2026. Last updated: October 21, 2026. Status: Monitoring

Summary

On October 21, 2026, the PHP project released security updates to address two critical vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). If left unpatched, these vulnerabilities could allow an attacker to run code on an affected web server without logging in. SavvyMoney has reviewed its environment for exposure to these vulnerabilities.

Impact on the SavvyMoney Platform

The SavvyMoney platform does not use PHP. That includes the credit score widget, APIs, single sign-on integrations, and the services that store or process member data. These vulnerabilities do not affect the SavvyMoney platform or the data we process on behalf of our partners.

Impact on the SavvyMoney Marketing Website

Our public marketing website (www.savvymoney.com) runs on WordPress and PHP. A managed hosting provider hosts it. The website contains no member or partner data and is not connected to the SavvyMoney platform. Our hosting provider has implemented protections against these vulnerabilities at its network and hosting layers and applied PHP security updates across its platform.

Action Required

No action is required from our partners or their members.

Our Ongoing Commitment

SavvyMoney monitors security advisories and assesses new vulnerabilities as part of our vulnerability management program. We will update this notice if anything changes.

Contact

If you have questions about this advisory, please contact your SavvyMoney relationship manager or email security@savvymoney.com.

Dear Partner,

We want to provide clarity regarding the recently reported Shai Hulud 2.0 supply-chain malware affecting specific open-source packages. SavvyMoney has completed an internal review and has not been impacted.

Validated Findings

• There is no evidence of impact to SavvyMoney’s codebase, infrastructure, partner integrations, or production systems.
• Our security team performed a full review of dependency packages, development pipelines, and build systems. No affected components were identified.
• As part of standard protocol, we confirmed all credentials, pipeline secrets, and access tokens remain secure and rotated as required by policy.
• All SavvyMoney services are operating normally, and no action is required from partners.

We take supply-chain security seriously and continue to monitor this event in coordination with our security vendors and ecosystem partners. If new information emerges, we will notify you.

If you have any questions, please contact SavvyMoney Security at security@savvymoney.com.

Thank you,
SavvyMoney Security Team

We know about the recent Shai-Hulud npm supply-chain attack, in which malicious versions of multiple npm packages were published with a post-install script that harvested sensitive data and propagated further via compromised tokens.

At this time, SavvyMoney is not impacted by this attack. We have reviewed our dependencies and supply chain; no affected package versions have been used within our platform.

What We Do to Keep You Secure

• We maintain a rigorous dependency audit process, including automated and manual reviews.
• All third-party libraries are vetted for known vulnerabilities before being used.
• We monitor threat intelligence feeds continuously and have teams ready to respond to emerging security risks.
• Any credentials, tokens, or secrets in use follow strict access controls and are rotated regularly.
• We use secure build pipelines, code signing, and environment isolation to limit exposure.

What You Can Do

While you can trust that SavvyMoney is not impacted, we encourage clients and users to:

• Review your own environments for any dependency vulnerabilities.
• Ensure that npm tokens, GitHub tokens, or other credentials are stored securely.
• Rotate any keys or secrets if there is suspicion of exposure.

Recent reports confirm that a data breach at TransUnion affected approximately 4.4 million U.S. consumers. The incident was tied to a third-party Salesforce application used in their consumer support operations. No TransUnion credit databases, credit scores, or credit reports were impacted.

SavvyMoney’s platform and Salesforce environment were not affected. We do not use Salesloft, Drift, or similar Salesforce integrations targeted in this campaign.

TransUnion will notify any affected consumers directly and provide credit monitoring services. SavvyMoney continues to monitor the broader Salesforce supply chain issue and validate vendor integrations as part of our security practices.

We proudly announce that SavvyMoney has achieved the Cloud Security Alliance (CSA) STAR Level II Certification. This prestigious certification underscores our unwavering commitment to cloud security and data protection.

The CSA STAR Level II Certification is a rigorous, independent assessment that evaluates the security measures we have implemented to protect our clients' data. This certification validates our robust security framework and demonstrates our dedication to maintaining the highest cloud security standards.

At SavvyMoney, we strive to give our clients the utmost confidence in our security practices. Achieving the CSA STAR Level II Certification reinforces our promise to safeguard sensitive information and deliver exceptional service.

Please login to download the CSA STAR Level II Certification.