pasUNITY Is Not Affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

On October 21, 2026, the PHP development team disclosed two critical vulnerabilities, collectively known as “PHP2Shell.” CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities in PHP itself that let an attacker run code on a server with a crafted HTTP request, without signing in. PHP rates both 9.2 (critical) and fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Our assessment

Following the disclosure, pasUNITY reviewed all of its externally accessible systems and services for exposure to these vulnerabilities.

pasUNITY is not affected. None of our internet-facing applications or services use PHP. Our hosted applications are built on Microsoft .NET and run on Microsoft IIS, and no PHP runtime or PHP handler is present on the systems that serve them. Because both vulnerabilities exist within the PHP runtime itself, systems that do not run PHP cannot be exploited through them.

This assessment was confirmed through an automated inventory of every server in our data center, which verified that no PHP binaries, IIS PHP handler mappings, or PHP-related software are present.

What this means for our clients

No action is required on your part, and there has been no impact to the availability, integrity, or security of any pasUNITY-hosted service.

Our ongoing commitment

Security is a core part of how we operate. We continuously monitor vendor and industry security advisories, routinely scan our environment for vulnerabilities, and will update clients promptly should any new information affect this assessment.