Palantir response to PHP CVE-2026-109618 and CVE-2026-109619 (PHP2shell)

Summary:
Palantir's actively supported products and managed production infrastructure are not affected by PHP2shell (CVE-2026-109618 and CVE-2026-109619). PHP is not utilized in our products.

Proactive mitigations and applicable patches have been deployed across production and internal services. Investigation of internal systems and Palantir production environments has found no indications of abuse.

Details:
Palantir has been tracking the public release of exploit code (PHP2shell) targeting the two PHP vulnerabilities that allow unauthenticated remote code execution (RCE) and pose a critical risk to all PHP installations serving web requests. PHP has released the patched versions of 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

After a comprehensive review, Palantir has confirmed that there are no vulnerable PHP versions in our actively supported products. Palantir has no reliance on and has found no evidence of the impacted PHP versions in our managed/hosted production infrastructure.

A vulnerable dependency in a deprecated service deployed in a small number of air-gapped environments was promptly patched.

Customers are strongly advised to review and patch affected customer-managed systems. See the PHP Security Advisory: https://www.php.net/index.php

We have conducted a thorough investigation and validated that we are not impacted by the Axios breach. The malicious Axios package was never published to any Palantir production environments.

Security Bulletin

Bulletin ID: PLTRSEC-2025-52

CVE: CVE-2025-68427

Affected Products / Versions: N/A

Publication Date: April 7, 2026

Summary

Object Security Policies configured on Pipeline Builder-backed object types were being silently deleted during pipeline deployments on Foundry stacks. This could have resulted in unintended data exposure where manually configured row-level security restrictions were removed without warning, potentially allowing users to view object instances they should not have access to. The affected service has been patched and automatically deployed to all Apollo-managed Foundry instances.

Background

A software defect in Palantir's Pipeline Builder deployment process caused Object Security Policies to be silently deleted whenever a pipeline was redeployed. When administrators manually configured security policies on object types backed by Pipeline Builder, subsequent pipeline deployments would completely drop these security configurations without any warning or notification.

This behavior could have resulted in sensitive data becoming visible to users who should have been restricted by the deleted security policies. The issue affected any object type that was both backed by Pipeline Builder and had custom Object Security Policies applied.

Palantir's information security team conducted a thorough investigation of affected instances and reviewed access patterns to determine if any unauthorized data access occurred as a result of this defect. The team is working directly with impacted customers to assess the scope and restore appropriate security policies where necessary.

Details

Object Security Policies are a critical security feature in Foundry that allow administrators to configure view permissions at the object instance level by defining security policies on object types. These policies operate independently of the underlying data source permissions and are essential for implementing row-level security controls.

Remediation

This defect has been resolved and the fix has been rolled out to all affected Foundry instances. Pipeline deployments now properly preserve Object Security Policies configured on Pipeline Builder-backed object types.

Timeline

N/A

Acknowledgement

This issue was identified internally at Palantir.

• Palantir has been tracking the compromise of Aqua Security’s Trivy supply chain for several weeks. We have tracked the existence of additional vulnerable releases, confirmed by further reporting from other industry sources.
• Palantir has evaluated any and all links to the vulnerable version across the entire Palantir developer and endpoint landscape and confirmed no compromise.
• Palantir has confirmed no vulnerable versions were released in our Container Vulnerability Scanning (CVS) tool for our Apollo container vulnerability scanning or Foundry container vulnerability scanning features.
• Palantir has frozen our CVS scanning engine on the last known safe version of Trivy. Vulnerability databases continue to be kept up to date.
• Palantir is urgently evaluating replacement vulnerability scanning tools, has already deployed an alternative scanner in an internal beta, and is performing further analysis to confirm security outcomes are met by the alternative scanner. A final decision will be made regarding our future state scanning engine in the coming weeks.

We are aware of a viral social media post claiming that Palantir Technologies has been hacked. These claims are unverified and unfounded.