PHP2Shell vulnerabilities
Issue
PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026.
These are classified as critical vulnerabilities, with CVSS 4.0 scores of 9.2 / 10, which may allow unauthenticated remote code execution on affected systems.
Updates
- October 22, 2026 - 17:15 UTC: DSOS version 5.0.0 released with the fixes for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. All customers should update to DSOS version 5.0.0 as soon as possible.
Impact on SpinetiX products
DSOS
DSOS versions 4.0.0 through 4.10.0 include PHP versions affected by these vulnerabilities.
All customers should update to DSOS version 5.0.0 as soon as possible.
DSOS includes PHP components used by the Control Center, RPC and DiVA CMS functionalities.
As a security best practice, SpinetiX recommends that devices running DSOS are not directly reachable from the Internet and are accessible only from trusted networks whenever possible. Customers with Internet-facing DSOS devices should immediately restrict access until those devices have been updated to DSOS 5.0.0 or later.
DSOS version 5.0.0 was released on 22 October 2026 at 17:15 UTC and includes fixes for these vulnerabilities. Although the PHP version is reported as 8.1.34, it includes backported fixes for CVE-2026-109618 and CVE-2026-109619.
The predecessor of DSOS, HMP firmware versions 1.0.4880 to 3.4.8, includes PHP 5.3 or earlier, which is reportedly not affected by PHP2Shell. However, support for these HMP firmware versions ended in January 2020 or earlier, and they contain components affected by numerous other known vulnerabilities.
Elementi
Elementi does not include any PHP components and is therefore not affected by PHP2Shell.
Cloud infrastructure
The SpinetiX cloud infrastructure does not use PHP and is therefore not affected by PHP2Shell.
SpinetiX web sites
Some SpinetiX websites use PHP and were therefore potentially affected by these vulnerabilities. The websites are hosted by Infomaniak, which has confirmed deployment of the PHP security updates addressing PHP2Shell. According to the hosting provider, the remediation was completed on October 22, 2026 at 05:42 UTC.