Progressive Solutions, Inc.Est. 1979

Security notice

PSI is not affected by PHP2Shell

CVE-2026-109618 and CVE-2026-109619 · Published 21 October 2026 by Noah Moerbeek

Summary. PSI products are built on Microsoft .NET, not PHP, and are not affected by the PHP2Shell vulnerabilities. Agencies do not need to take any action for PSI systems.

What PHP2Shell is

PHP2Shell is the name given to two vulnerabilities in the PHP language runtime, CVE-2026-109618 and CVE-2026-109619. PHP released fixes on 21 October 2026. Both are rated critical, with a CVSS v4.0 score of 9.2.

  • No login required. An attacker can run their own code on a vulnerable web server without credentials.
  • Wide reach. PHP versions from 5.4 through 8.x are reported as affected. Branches that are past end of life are not expected to receive fixes.
  • Already being exploited. Technical details leaked before the fixes were released, and security researchers reported attacks starting the same day.
  • Data exposure. CVE-2026-109618 can also leak server memory, which may expose sensitive information.

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Why PSI products are not affected

  • No PHP in our products. LicenseTrack™, PaymentCentral™, UtilityExplorer™, PetTrack™, the OneStop™ portals and our other modules are built on Microsoft .NET (ASP.NET and Blazor) and run on Microsoft IIS on Windows Server. The vulnerable PHP code is not part of any PSI product.
  • No PHP in our application hosting. The servers that host PSI applications for agencies run the .NET runtime and Microsoft SQL Server. PHP is not part of that environment.
  • Checked on 21 October 2026. We reviewed our public web endpoints after the disclosure. Our application and corporate sites are served by Microsoft IIS and ASP.NET, and requests for PHP pages are not handled by a PHP engine.

What agencies should do

Nothing is required for PSI systems. If your agency runs PHP elsewhere, for example a WordPress site or another PHP application, we recommend updating to a fixed release as soon as possible and following your web host’s guidance.

Questions

If your IT or security team needs a written statement for your records, email support@progressivesolutions.com or call 714-671-1597.

References: Tenable FAQ · Sansec research · Help Net Security