PHP2Shell: What US Businesses Need to Know—and Why Arez Isn’t Affected

For IT teams, this week brought an unwelcome addition to the to-do list: checking whether their systems were exposed to two critical PHP vulnerabilities.

The news surfaced on Hacker News on Tuesday, ahead of the planned disclosure. The post disappeared, but the warning had already spread. By Wednesday afternoon, emergency patches were available and reports of attempted exploitation were emerging.

Since then, several customers have contacted us with a straightforward question: does this affect Arez?

The answer is no. Here’s why, along with what your IT team should check elsewhere.

Understanding PHP2Shell

PHP2Shell refers to two vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. Both carry a critical severity rating of 9.2 out of 10.

These flaws can allow an attacker to execute code on an affected web server without signing in. That creates a serious risk for organizations running vulnerable PHP-based websites and applications.

PHP issued emergency fixes on October 21 and urged users to update immediately.

Why the Arez platform is unaffected

The Arez application platform was built without PHP and does not depend on it.

That includes FieldIQ for facilities and field service management, Operate for workforce and shift management, Inspect for inspections and compliance, and Frost for winter maintenance, along with our native iOS and Android apps.

No PHP-related patching is required for the Arez application platform.

Your teams can continue scheduling maintenance, dispatching technicians, managing shifts and completing inspections as usual. There are no customer settings to change and no downtime to schedule in connection with PHP2Shell.

Four checks for your other business systems

Arez is only one part of your technology environment. PHP is widely used across business websites and applications, including WordPress.

If your organization uses PHP-based websites, booking systems, customer portals or internal tools, ask your IT team or hosting provider:

1. Have the security updates been installed and activated? Confirm that affected services have been restarted or reloaded where required. Also review PHP’s October 23 advisory on session upload progress and apply the relevant configuration guidance.
2. Has the installed package been checked against the vendor’s advisory? Some Linux distributions backport security fixes while