PHP2Shell Vulnerability: How It Affects ProIT-Supported Products

This post explains what the PHP2Shell vulnerability is and why it matters for your organization. It covers the current status of every product our ProIT team supports, including which products need no action, which have been patched, and which need a customer update. We'll also share a few practical steps you can take to protect the rest of your environment.

What Is the PHP2Shell Vulnerability?

PHP is a programming language that powers a large share of the world's websites and web applications. On October 20, 2026, the PHP security team gave advance notice of two critical flaws. Full public disclosure and vendor patches followed on October 21.

Together, these flaws are known as PHP2Shell. Both allow unauthenticated remote code execution (RCE). An attacker could run their own code on a vulnerable web server without needing a username or password. They affect any web server running PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.

CVE-2026-109618: RCE via Out-of-Memory Corruption

An out-of-memory condition can interrupt PHP while it's still setting up internal request data. When PHP cleans up that request, it may treat the half-finished data as valid. That mismatch can let an attacker execute code.

CVE-2026-109619: RCE via Stale Global State

Internal data tied to one request can stick around after its memory has been freed. If the same worker handles a later request, it may use that leftover data before normal setup resets it.

Why IT Leaders Should Care

Both CVEs are rated Critical (CVSS v4.0 9.2). Unauthenticated RCE flaws are among the most dangerous types of vulnerabilities because they're easy to target and can lead to full server compromise. For any organization handling sensitive documents, faxes, or print data, a breach could create serious compliance and data security problems.

Product-by-Product Status

Our team at ProIT contacted the support teams for every customer-facing product we support. Their responses are summarized below.

Quick Reference

Not Affected: Products That Don't Use PHP

The following products don't include a PHP runtime or rely on PHP-based components. That means they aren't exposed to PHP2Shell, and no customer action is needed.

CoreFax/XMedius

OpenText's development teams confirmed that none of these products use PHP. This covers OpenText Fax (RightFax), OpenText Fax Private Cloud, OpenText Fax Cloud Connect, Fax2Mail, and Core Fax, along with Core Messaging, BMS, and EWS. The confirmation applies to all released versions.

CloudStream

Ricoh shared YSoft's confirmation that CloudStream doesn't use PHP. YSoft, which develops CloudStream for Ricoh, checked this against its cloud workload inventory, source code repositories, and software bill of materials (SBOM). No instances of either CVE were found in their product environments.

PaperCut Hive and PaperCut MF

PaperCut doesn't use, bundle, or rely on PHP in any of its products. You may notice sample .php files in the PaperCut NG/MF installation directory under server/examples/webservices/php/. These are inert reference examples for developers working with the XML-RPC API. PaperCut doesn't bundle a PHP interpreter or execute PHP code, so these files pose no risk.

uniFLOW Online and uniFLOW*

NT-ware confirmed that uniFLOW Online, uniFLOW Server, sysHUB, and their related applications and services don't run PHP. As an extra precaution, NT-ware also patched its external-facing web services by 5:00 p.m. CEST on October 21, one hour after full public disclosure.

*uniFLOW Server Notes

Older uniFLOW Server versions. Versions older than 2023 LTS, 2022v2, 2022 LTS SR1 and 2021 LTS SR6 include a PHP folder (..\Program Files (x86)\uniFLOW\PHP\) for the retired uniFLOW Snapshot Tool. It doesn't run as a web service and can't be exploited, and you can safely delete it.

uniFLOW Internet Gateway. The Internet Gateway reached end of life in 2022 and is affected on the few custom installs still running. NT-ware's guidance is to move off the Internet Gateway to a supported product, such as a hybrid uniFLOW Online setup, rather than patch it. If you're still running it, contact us and we'll help you plan the move.

DocuWare and DocuWare Cloud

DocuWare Cloud and DocuWare On-Premises don't use PHP and aren't affected.

Infinity Cloud

Process Fusion confirmed that Infinity Cloud is built on Microsoft .NET and doesn't use PHP in any of its services. Its security team also reviewed Infinity Cloud's hosting infrastructure, supporting systems, and third-party components and found no exposure. Process Fusion's public websites (processfusion.com and uniprint.net) do use PHP and have been patched. Those sites are separate from Infinity Cloud and don't store or process Infinity Cloud customer data.

Laserfiche and Laserfiche Cloud

Laserfiche products don't use PHP. However, Laserfiche Mobile Server installs some .php test files that came bundled with a third-party library. They aren't used to run the server and can be safely deleted. You'll find them in the "dijit" and "dojox" subfolders of <Install path>\Web Files\js-src.

Patched: WestFax

WestFax does use PHP in some systems. Its security tools flagged the issue on the evening of October 20, and WestFax applied interim mitigations before a patch even existed. Patched PHP versions were installed the morning of October 21, as soon as packages became available.

WestFax found no evidence of exploitation, and no client action is required.

Action Required: PrinterLogic Virtual Appliance

Vasion has patched PHP in all Vasion-hosted PrinterLogic services, including FedRAMP, so cloud customers don't need to do anything for PHP2Shell. If you run the PrinterLogic Virtual Appliance on your own network, upgrade it to host 26.2.362 (released October 30), which includes the PHP fix. Vasion also recommends that all customers update their Agent and Service Agent software to address a separate certificate issue (the eMudhra intermediate CA compromise). If automatic updates are turned off, this has to be done manually.

What Your Team Should Do Now

Even if your ProIT-supported products are in the clear, PHP may still live elsewhere in your environment. We recommend the following steps:

• Inventory your PHP use. Look for public websites, content management systems, intranet portals, and custom integrations that may run PHP.
• Patch right away. Follow guidance from the PHP project and your operating system vendor for any PHP installations you find.
• Prioritize internet-facing systems. Public web servers carry the highest risk, so patch those first.
• Upgrade PrinterLogic Virtual Appliances. If you host your own PrinterLogic Virtual Appliance, upgrade it to host 26.2.362.
• Review custom integrations. If you've built scripts or connectors that touch our supported products using PHP, those need attention too.
• Optional cleanup. If you run Laserfiche Mobile Server or an older uniFLOW Server, consider deleting the unused .php test files and the uniFLOW PHP folder mentioned above.

For example, a company running PaperCut MF for print management and a PHP-based employee portal would need no changes to PaperCut. The portal, however, should be patched immediately.

Frequently Asked Questions

Do I need to update any ProIT-supported products because of PHP2Shell?

Only if you run a PrinterLogic Virtual Appliance or the end-of-life uniFLOW Internet Gateway (see above). Every other product is either not affected or already patched by the vendor.

I found .php files on my PaperCut, Laserfiche or uniFLOW server. Should I be worried?

No. These are leftover reference, test or retired files. None of these products runs them, so they do nothing on their own.

Was any customer data exposed?

None of the vendors that have responded reported evidence of exploitation in their product environments.

ProIT Is Monitoring the Situation

Erick Miller, our VP of Technology Solutions, is leading ProIT's response to PHP2Shell. His team is staying in close contact with each vendor and tracking new developments as they happen.

The vast majority of the products we support aren't affected, WestFax and Vasion's hosted PrinterLogic services have already been patched. The only customer actions are the PrinterLogic Virtual Appliance upgrade and moving off the uniFLOW Internet Gateway. We'll update this post if anything changes.

If you have questions about your environment or want help reviewing other systems for PHP exposure, reach out to your ProIT account team.