PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”)

Issued 23rd October 2026

Summary

On 21st October 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell”. Payter has assessed its products and infrastructure against these advisories.

Assessment

Payter does not use PHP in any of its systems. No Payter terminal firmware, operating system, application, gateway, or hosted cloud environment contains a PHP runtime, interpreter, or PHP-based dependency.

Payter is therefore not affected by CVE-2026-109618 or CVE-2026-109619.

Action required

No action is required by Payter customers or partners in relation to Payter products and services.

This statement addresses Payter’s own products, infrastructure, and hosted services only. It does not constitute an assessment of any other system in a customer’s or partner’s environment. Customers operating PHP-based applications elsewhere in their estate should apply the remediation guidance published by the PHP project and their own vendors.

Ongoing monitoring

Payter continuously monitors published vulnerability disclosures affecting its products, infrastructure, and supply chain, and will issue further statements where a material impact is identified.