What are the recently reported PHP vulnerabilities?
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have recently been identified in PHP, a widely used technology for running websites and web applications. The vulnerabilities could potentially allow an unauthenticated attacker to execute code on a server running an affected version of PHP.
PHP has released security updates addressing these vulnerabilities.
Are Transoft Solutions products affected?
Our assessment has confirmed that My Transoft Portal, InSTRATO and our other SaaS applications are not affected by these PHP vulnerabilities. Our desktop products, including AutoTURN, AviPLAN and TrafxPLAN Suite, and all others are also unaffected
Are Transoft Solutions websites affected?
PHP is used within some of Transoft's web infrastructure. Following disclosure of the vulnerabilities, we reviewed the relevant websites and worked with our hosting providers to apply the necessary updates.
The official PHP security patches have now been successfully applied to all Transoft and CGS websites.
What action has Transoft Solutions taken?
We responded to the disclosure by:
- reviewing our products and services to identify potential use of affected PHP versions;
- confirming that our SaaS and desktop products are not affected;
- working with our hosting providers to apply the appropriate security updates to our web infrastructure; and
- confirming that the official PHP security patches have been applied across Transoft and CGS websites.
We are continuing to monitor developments relating to these vulnerabilities as a precaution.
Do customers need to take any action?
No action is required by customers in relation to Transoft Solutions products or services.
Customers who independently operate PHP-based systems should assess those environments separately and follow the guidance provided by PHP and their relevant hosting or technology providers. Current remediation guidance is to apply an appropriate patched PHP release.
Has customer data been affected?
Our assessment has not identified an impact to My Transoft Portal, InSTRATO or our other SaaS applications from these vulnerabilities.
Which vulnerabilities does this statement relate to?
This FAQ relates specifically to:
- CVE-2026-109618
- CVE-2026-109619
Both have been classified as critical remote-code-execution vulnerabilities. PHP released fixed versions on 21 October 2026.
Where can I get further information?
Customers with specific security questions about Transoft Solutions products can contact their usual Transoft Solutions support representative.
PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619 Fixes
Answers on PHP2Shell (CVE-2026-109618, CVE-2026-109619): affected PHP versions, fixed releases, exploitation status and what to do now.