Who is this article for?

Customers of any Ideagen product who want to understand the recently disclosed PHP security vulnerability and how it affects their Ideagen products.

No special access or permissions are required.

This article answers common questions about the critical PHP security vulnerability disclosed in October 2026 (known as "php2shell") and the action Ideagen has taken to protect customers.

Last updated: [DD Month 2026, HH:MM timezone]

In this article

• Summary
• About the vulnerability
• Impact on Ideagen products
• Your data and security
• What you need to do
• Service restoration
• Further information and support
• Article change log

Summary

• A critical security vulnerability has been found in PHP, a widely used technology that runs many of the world's websites and web applications.
• This is a global issue affecting organisations worldwide. It is not specific to Ideagen.
• For Ideagen products that use PHP, we acted as a precaution, temporarily taking services offline or disabling features while we apply and test security updates.
• We have no evidence that customer data or environments have been affected.
• Ideagen-hosted customers don't need to do anything.

About the vulnerability

What is PHP?

PHP is a widely used programming language that runs on web servers. It powers a large share of the world's websites and web applications.

What is the vulnerability?

Two related vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on 20–21 October 2026. Together they are known as "php2shell". If left unpatched, they could allow an attacker to run commands on a web server running PHP without needing to log in.

How serious is it?

Both vulnerabilities are rated critical (CVSS v4.0 score of 9.2). Government cyber security agencies, including the UK's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA), have advised organisations to take immediate action.

Is this an Ideagen security incident?

No. This is a vulnerability in PHP itself, which is used by organisations around the world. It is not caused by Ideagen software, and it is not a breach of Ideagen systems. Our actions are precautionary, to protect customers before any impact could occur.

Has a fix been released?

Yes. The PHP project released fixed versions on 21 October 2026. Our teams are applying and testing these updates across the affected Ideagen products.

Impact on Ideagen products

How do I know if my product is affected?

We're contacting customers directly to confirm the status of the products they use. If you'd like to check, please contact Ideagen Support.

Why are some Ideagen products affected and others not?

Ideagen products are built on a range of different technologies. Only products that use PHP are affected by this vulnerability. Products built on other technologies are not affected.

Why did Ideagen take some services offline?

Because this vulnerability is critical and is being actively targeted worldwide, the safest way to protect customers was to temporarily take affected services offline, or disable affected features, while we apply and test the fix. This follows guidance from government cyber security agencies.

Why wasn't I given advance notice?

Details of the vulnerability were made public earlier than planned, and attacks began soon after. We acted quickly to protect customers and sent communications as soon as possible. We're sorry for the short notice and the disruption this has caused.

Your data and security

Has my data been accessed or affected?

We have no evidence that customer data or environments have been affected. Our security teams are continuing to monitor and review our systems. If this changes, we'll contact affected customers directly.

Has any of my data been lost or changed while a service was offline?

No. Taking a service offline doesn't delete or change your data. Your records will be available as normal when the service is restored.

Do I need to change my password?

This vulnerability is not related to passwords or user accounts, and we're not asking customers to change passwords. If this changes, we'll tell you directly.

Can I get a statement for my organisation's security team?

Yes. Please contact Ideagen Support or your Customer Success Manager and we'll provide written confirmation of your products' status.

What you need to do

Do I need to take any action?

If Ideagen hosts your product, you don't need to do anything. Our teams are handling all security updates.

If you host an Ideagen product on your own servers, please contact Ideagen Support for guidance.

What should I do while a service is unavailable?

We recommend using your organisation's manual or business continuity process for any tasks you'd normally complete in the affected product. Once the service is restored, you can enter any manually captured records as usual.

Service restoration

When will affected services be back online?

We're working to restore services as quickly as possible. Before bringing each one back, we make sure the security updates are fully applied and tested. We'll confirm restoration directly with affected customers and update this article.

How will I be kept informed?

Affected customers will receive email updates at regular intervals until their service is restored. This article will also be updated as the situation changes.

Further information and support

Where can I find more information about the vulnerability?

• National Cyber Security Centre (UK): Critical security issue affecting PHP
• CISA (US): Critical vulnerabilities in PHP require immediate patching
• PHP security advisory

Who can I contact with questions?

If you have any questions, please contact Ideagen Support via our support portal or speak to your Customer Success Manager. We're happy to help.