Voatz has reviewed two widely reported security events from October 2026 and confirmed that neither affects the Voatz election platform.
Two security events received wide coverage this month. Because election officials, partners and voters rightly ask whether events like these affect the systems they rely on, we want to be clear and specific about both.
The PHP2Shell vulnerabilities
On October 21, 2026 the PHP project released fixes for two critical vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. They allow an unauthenticated attacker to execute code on a vulnerable web server, and exploitation has been observed in the wild. A third, related vulnerability, CVE-2026-115560, was disclosed on October 23.
The Voatz election platform does not use PHP. No component of the voting application, the election administration portal, the audit portal or the services behind them is written in or executed by PHP, so none of them were exposed to these vulnerabilities. There was nothing to patch and no impact.
Separately, our corporate website at voatz.com, which carries public information and is not connected to any election system, has been moved to a static architecture with no server-side code at all. No election, voter or customer data was ever stored on it.
The eMudhra certificate compromise
On October 17, 2026 a researcher disclosed that eight intermediate certificate authority certificates operated by eMudhra had been issued with private keys that could be recovered from the certificates themselves. The certificates were revoked, and Google, Mozilla, Apple and Microsoft have removed trust in them from their browsers and operating systems.
Voatz does not use eMudhra certificates anywhere. The certificates that protect connections to the Voatz platform, our administrative portals and our public website are issued by other certificate authorities, and none of them chain to the affected eMudhra intermediates. We also confirmed that the Voatz applications do not rely on the affected intermediates to validate any connection they make. There was no impact.
How we approach events like these
Every publicly disclosed vulnerability that could plausibly touch our stack is reviewed by our security team against an inventory of the software, libraries and certificate chains we actually use. Where a component is affected, we patch and verify; where it is not, we document the reasoning. Our independent audits, our public bug bounty program and our ISO/IEC 27001 certification are described on our Security & Technology page.
If you are an election official or partner with questions about either event, please contact us.
Update: October 26, 2026
On October 26 the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, confirming active exploitation and directing federal agencies to apply the PHP patches. This does not change our assessment: the Voatz election platform does not use PHP and remains unaffected.
