On 20 October 2026, two critical vulnerabilities in the PHP programming language were disclosed (CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell"). As a precaution, we would like to inform you about the status of the FACT24 solutions.
The FACT24 ENS, FACT24 ENS+ and myENS product platforms do not use PHP and are therefore not affected by these vulnerabilities. No action is required on your part.
Within the FACT24 product family, only the CIM applications use PHP. Technical mitigation measures were implemented on 21 October 2026, and customers using these applications were informed directly. The PHP security updates released on 21 October 2026 were tested and deployed on the same day, thereby resolving the vulnerabilities. The affected systems were examined for signs of unauthorized access. Based on our current findings, there is no evidence of such activity. We will continue to monitor the situation and inform you if any new relevant findings emerge.