CyberSmart security update: PHP vulnerabilities (PHP2Shell)
22 October 2026
Following the recent disclosure of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively referred to as PHP2Shell, we want to reassure our customers and partners that we have identified no evidence of compromise or disruption to CyberSmart's products, services or customer data as a result of these vulnerabilities.
Protecting our customers and partners is our highest priority. Following the disclosure, we proactively reviewed our own infrastructure and worked closely with our third-party technology providers to assess potential exposure and ensure appropriate mitigations were in place.
Our assessment and actions taken
- CyberSmart Platform: Our core web and desktop applications do not use PHP and are not affected by these vulnerabilities.
- CyberSmart Website: Our web application firewall (WAF) provided protection against the vulnerabilities before they were publicly disclosed, and our hosting provider has subsequently deployed the patched PHP release (version 8.5.12).
- CyberSmart Partner Community: Our community is hosted on Circle, which does not use PHP for the relevant service and is not affected.
- Third-party technology providers: We have engaged with our key technology partners to verify their security posture:
- Trustd Mobile (Active Protect for Mobile): Completed a comprehensive security assessment of the infrastructure supporting the CyberSmart app, confirming no exposure to the vulnerabilities and no evidence of exploitation or compromise.
- Rootshell (CyberSmart Vulnerability Manager): Confirmed that patched PHP versions have been deployed across all environments, including pre-production, beta and live production, with continued security monitoring in place.
- Qualys (CyberSmart Vulnerability Manager & Vulnerability Insights): Confirmed that its security assessment has identified no risk to its platforms or impact on the services, APIs or integrations used by CyberSmart. No evidence of exploitation or impact to customer data has been identified. Qualys has also confirmed that preventative security controls, including WAF and intrusion detection/prevention systems, are in place and have been validated.
- OPSWAT (CyberSmart Active Protect & Patch): Based on the product-level security assessment, the OESIS Framework SDK and its content delivery services do not use PHP and are not affected.
- Bob’s Business (CyberSmart Learn): Confirmed that affected PHP components within its infrastructure were promptly isolated or patched following disclosure, with all security fixes now fully deployed. A comprehensive security investigation found no evidence of exploitation, unauthorised access or data compromise, and no further action is required.
Ongoing monitoring and assurance
CyberSmart continues to monitor its systems for indicators of compromise (IOCs) and remains in close contact with our technology partners to identify and respond promptly to any emerging risks.
Based on the assessments completed to date, we have identified no evidence that these vulnerabilities have compromised the security, integrity or availability of CyberSmart's products, services or customer data.
We will continue to review developments and provide further updates should any new information materially change our assessment.
If you have any questions or concerns, please contact CyberSmart at hello@cybersmart.co.uk.
The CyberSmart Team