Over the past few days, many of our customers have asked us the same question: are we affected by the new PHP vulnerability? The short answer is no. This post explains what happened, why appsolut's systems are not at risk, and how we can help if your own systems are.
What happened
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language that runs a large share of the web, from company websites to online shops and content management systems. The flaws let an attacker run their own code on a web server that uses PHP, without logging in and without any action by a user. On 26 October, the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its catalogue of vulnerabilities known to be exploited in the wild.
Anyone who runs PHP should update to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 straight away, starting with systems that can be reached from the internet. Older PHP versions that no longer receive updates should be taken offline until they are replaced.
appsolut's systems are not affected
None of the systems appsolut develops and operates run PHP, and that includes appsolut ONE. We stopped using PHP years ago. There is nothing to patch on our side, and there is no action you need to take for your use of appsolut ONE.
Built on a modern stack, secured by design
appsolut ONE is built on a current, actively maintained development stack. A vulnerability like PHP2Shell is a reminder that security depends on more than any one technology, so we rely on several layers of protection that work together:
- Your data stays yours. Each customer's data is kept strictly separate from every other customer's, and the separation is enforced in the database itself, not only in the application.
- Secure sign-in. Multi-factor authentication and bot protection guard access to the Studio and to your portals.
- Up to date, continuously. The software components we build on are checked and updated automatically and continuously, so security fixes reach our systems quickly. Our code is also scanned automatically so that no access credentials can slip into it.
- Every change is checked. Before any change is released, it passes automated tests and a separate security review.
- Professionally run infrastructure. appsolut ONE runs on a modern, managed hosting platform that applies security updates without delay.
- Encrypted connections. All data travelling between your browser, your portals and appsolut ONE is encrypted.
We are here if you need us
Our own systems are not affected, but some of yours may be: a company website, an older intranet or a tool that has run quietly for years. If you are unsure whether you run PHP, or you need help updating or replacing an affected system, get in touch. We will help you find out where you stand and what to do next.