Apteco and PHP2Shell vulnerabilities - Apteco products not affected

We are aware of the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, commonly referred to as PHP2Shell. Apteco has reviewed its products and services for potential exposure to these vulnerabilities.

Apteco products, including FastStats, PeopleStage and Orbit, are not affected by these vulnerabilities. Our products do not rely on the affected PHP functionality and no updates to Apteco products are required in response to PHP2Shell.

As part of our review of Apteco-operated online services, we identified a partner-facing service that uses PHP - the Apteco Partner Portal. This service was updated to a patched version of PHP that addresses these vulnerabilities yesterday (Wed 21 Oct). We have also reviewed the Apteco Portal for indicators of attempted exploitation or compromise associated with PHP2Shell. Our investigation identified no evidence of successful exploitation or compromise.

What action should you take?

We are continuing to monitor security advisories and threat intelligence relating to PHP2Shell and will reassess our position should new information become available. NO ACTION IS REQUIRED from Apteco partners or customers in relation to Apteco services and PHP2Shell at this time.

• Product status: Not affected
• Apteco-operated services: Reviewed and remediated where applicable
• Vulnerabilities: CVE-2026-109618, CVE-2026-109619
• Last reviewed: 22 October 2026