What is PHP2Shell?
PHP2Shell refers to two critical security vulnerabilities in PHP that were disclosed on 21 October 2026. On servers running an unpatched PHP version, attackers can use them to execute code without logging in and to read data from memory.
Both vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are in PHP itself and affect all versions from 5.4 onwards. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Are signotec and my data affected?
Our products are developed without PHP and contain no PHP components. The vulnerabilities cannot be exploited through them, so your data, documents and signatures are not at risk.
Our ticket system is not affected either, as it does not use PHP.
Our website has already been updated to a secure PHP version.
Do I need to do anything as a costumer?
Not for signotec products. No updates or changes to our software are needed.
Independently of signotec, we recommend checking your own systems. If you run websites or applications on PHP yourself, such as WordPress, update them to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible. Please contact your IT department or hosting provider for this.
Sources: Wiz Research, PHP Foundation, Patchstack