Everyone’s Patching PHP This Week. Arez Isn’t Affected.

On Tuesday, someone posted on Hacker News that two serious PHP flaws were about to go public. The post was later deleted, but by then the news was out.

By Wednesday afternoon, PHP had shipped emergency fixes and there were already reports of people trying to exploit the flaws. If you work in IT, you’ve probably spent the last few days going through every system you look after and asking the same question: are we exposed?

A few of those questions landed with us, so here’s our answer.

So what is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10. In plain terms, they let an attacker run their own code on a web server without a username, a password or any kind of login. For a web server, that’s about as bad as it gets.

PHP released the fixes on 21 October and told everyone running it to update straight away.

Where Arez stands

PHP2Shell goes after PHP, and we don’t use it. We built the Arez application platform without PHP, and nothing in it depends on PHP. That covers FieldIQ, Operate, Inspect and Frost, plus our iOS and Android apps.

So the platform doesn’t need patching. You don’t need to do anything, change any settings or plan for downtime. Carry on using Arez today exactly as you did yesterday.

Your own systems are another matter

PHP runs a big slice of the web, WordPress included. If your company website, booking forms, customer portal or internal tools run on PHP, ask your IT team or hosting provider four questions today:

• Have the PHP security updates been applied, and have the services been restarted so the fix actually takes effect? PHP also published a second advisory today recommending that session upload progress stays switched off until its next release, so check that as well.
• Has the fix been checked against the official advisory, not just the version number? Some Linux distributions backport security fixes and leave the old version number in place, so the number on its own can mislead you.
• Is anything running a PHP version that’s out of support? If so, find out whether there’s an upgrade path or a fix from your vendor.
• Have the server logs been checked? Go back to before the news broke on 20 October, not just to the day the patches came out.
   

PHP’s security advisory has the full details, and your hosting provider or operating system vendor can tell you which updates apply to you.

Need this in writing?

If you need confirmation for supplier assurance or your security register, get in touch with your usual Arez contact or email support@uk.arez.io. You’ll find more on how we handle security, privacy and compliance in our Trust Centre.

#FacilitiesManagement #FieldService #ServiceDelivery #CyberSecurity