Summary
ZAPP products and services are not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. No action is required on Ecaldima instances, whether hosted by ZAPP or installed on our customers' premises.
| Item | Information |
|---|---|
| Reference | ZAPP-SA-2026-001 |
| Severity of the vulnerabilities | Critical (CVSS 9.2), actively exploited |
| Status of ZAPP products | Not affected |
| Action required | None on ZAPP products and services |
| Audience | ZAPP partners and customers |
The vulnerabilities
On October 21, 2026, the PHP maintainers released fixes for two critical vulnerabilities in the PHP engine, known as "PHP2Shell". They allow unauthenticated remote code execution with the privileges of the web server.
| Vulnerability | Severity | Fix |
|---|---|---|
| CVE-2026-109618 | Critical, CVSS 9.2 | PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 |
| CVE-2026-109619 | Critical, CVSS 9.2 | PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 |
| CVE-2026-115560 | Considered unlikely by PHP | Not yet released as of October 27, 2026 |
On October 26, 2026, the US agency CISA added the first two vulnerabilities to its catalog of actively exploited vulnerabilities. According to security specialists, only updating PHP protects against them: the configuration workarounds in circulation are not sufficient.
Scope assessed
No Ecaldima product uses PHP. The ZAPP websites, which do use it, have been updated.
| Product or service | Technology | Database | Status |
|---|---|---|---|
| Ecaldima V3 | ASP.NET MVC 4 | Microsoft SQL Server | Not affected |
| Ecaldima V4 | .NET 9 (ASP.NET Core) | PostgreSQL | Not affected |
| MyZapp portal | .NET 9 (ASP.NET Core) | PostgreSQL | Not affected |
| Ecaldima SaaS hosting (application servers, instance entry point, operations tools) | No PHP | — | Not affected |
| ZAPP websites | PHP | — | Fixed: PHP updated on October 22, 2026 |
Outside ZAPP's scope
This advisory covers only the products and services listed above. The systems, servers and applications that our partners or customers operate outside ZAPP products and services are the responsibility of their operator. It is up to the operator to assess their exposure and apply their vendors' fixes.
The allocation of responsibilities between ZAPP and its partners or customers remains as set out in the contracts in force. This advisory does not change it.
Follow-up and contact
ZAPP continues to monitor these vulnerabilities, in particular CVE-2026-115560. Should any of them affect a ZAPP product or service, we would publish a new version of this advisory without delay.
For any question, open a request on the MyZapp portal: https://myzapp.zappsl.com.
| Version | Date | Change |
|---|---|---|
| 1.0 | October 27, 2026 | First publication |
Sources
- CISA — Critical Vulnerabilities in PHP Require Immediate Patching
- Rapid7 — CVE-2026-109618 and CVE-2026-109619
- Datadog Security Labs — PHP2Shell
- The Hacker News — CVE-2026-115560
ZAPP SL — NIF B86408291 — Calle Asturias, 4, 28850 Torrejón de Ardoz (Madrid), Spain — contact@zappsl.com — Security advisory ZAPP-SA-2026-001, version 1.0 of October 27, 2026