On 21 October 2026, the PHP project released security updates for two critical vulnerabilities known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619).
PHP is a widely used programming language that powers websites and online services across industries. The vulnerabilities therefore represent a global security concern, as they could allow attackers to execute unauthorised code on affected servers without authentication. Prompt security updates are essential to address this risk.
We value the trust placed in Fairmas and take our responsibility for the security of our systems seriously. That is why we want to share how we reviewed our systems, what we found and the measures we took in response to these vulnerabilities.
Our Approach
Fairmas handled the vulnerabilities in line with our information security management processes, which are aligned with ISO/IEC 27001. Based on our inventory of all systems, we systematically checked every system for exposure, assessed the risk and prioritised the necessary measures.
Results and Measures
- We immediately took the affected systems offline, applied the necessary fixes, and reactivated them.
- All other systems in our inventory were not affected according to our review.
To date, we have no indication that the vulnerabilities have been exploited in our systems.
Continued Monitoring and Transparency
We continue to monitor the security advisories of the vendors of the infrastructure we use and apply their updates promptly.
By sharing the results of our review and the actions we have taken, we aim to provide clarity and reassurance, reflecting our commitment to transparent communication and the trust placed in Fairmas.
