Security News

As widely reported, a pair of critical vulnerabilities in the PHP language runtime (CVE-2026-109618 and CVE-2026-109619), called PHP2Shell, was disclosed in October 2026. These vulnerabilities let attackers run their own code on a web server that serves PHP pages, without needing to log in. They are already being exploited, and fixed PHP releases are available.

Neither StableNet^® nor any measurement script shipped by Infosim^® uses PHP. If there is a customer installed PHP runtime, we advise updating it to the latest version containing the fixes. Secure versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as of now.

If you run PHP-based applications elsewhere in your environment, such as websites, intranet tools or monitoring dashboards, check those systems separately and update them to a patched PHP release.