This post explains what the PHP2Shell vulnerability is and why it matters for your organization. It covers the current status of every product our ProIT team supports, including which products need no action, which have been patched, and which need a customer update. We'll also share a few practical steps you can take to protect the rest of your environment.
PHP is a programming language that powers a large share of the world's websites and web applications. On October 20, 2026, the PHP security team gave advance notice of two critical flaws. Full public disclosure and vendor patches followed on October 21.
Together, these flaws are known as PHP2Shell. Both allow unauthenticated remote code execution (RCE). An attacker could run their own code on a vulnerable web server without needing a username or password. They affect any web server running PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fix.
An out-of-memory condition can interrupt PHP while it's still setting up internal request data. When PHP cleans up that request, it may treat the half-finished data as valid. That mismatch can let an attacker execute code.
Internal data tied to one request can stick around after its memory has been freed. If the same worker handles a later request, it may use that leftover data before normal setup resets it.
Both CVEs are rated Critical (CVSS v4.0 9.2). Unauthenticated RCE flaws are among the most dangerous types of vulnerabilities because they're easy to target and can lead to full server compromise. For any organization handling sensitive documents, faxes, or print data, a breach could create serious compliance and data security problems.
Our team at ProIT contacted the support teams for every customer-facing product we support. Their responses are summarized below.
|
Product |
Status |
Customer Action Required |
|
CoreFax/XMedius |
Not affected (does not use PHP) |
None |
|
CloudStream |
Not affected (does not use PHP) |
None |
|
PaperCut Hive |
Not affected (does not use PHP) |
None |
|
PaperCut MF |
Not affected (does not use PHP) |
None |
|
uniFLOW Online |
Not affected (does not use PHP) |
None |
|
uniFLOW* |
Not affected (does not use PHP) |
None (see uniFLOW notes below) |
|
DocuWare |
Not affected (does not use PHP) |
None |
|
DocuWare Cloud |
Not affected (does not use PHP) |
None |
|
Laserfiche |
Not affected (does not use PHP) |
None (optional cleanup below) |
|
Laserfiche Cloud |
Not affected (does not use PHP) |
None |
|
WestFax |
Patched |
None |
|
Infinity Cloud |
Not affected (does not use PHP) |
None |
|
PrinterLogic |
Patched (Vasion-hosted) |
Virtual Appliance: upgrade to host 26.2.362 |
The following products don't include a PHP runtime or rely on PHP-based components. That means they aren't exposed to PHP2Shell, and no customer action is needed.
OpenText's development teams confirmed that none of these products use PHP. This covers OpenText Fax (RightFax), OpenText Fax Private Cloud, OpenText Fax Cloud Connect, Fax2Mail, and Core Fax, along with Core Messaging, BMS, and EWS. The confirmation applies to all released versions.
Ricoh shared YSoft's confirmation that CloudStream doesn't use PHP. YSoft, which develops CloudStream for Ricoh, checked this against its cloud workload inventory, source code repositories, and software bill of materials (SBOM). No instances of either CVE were found in their product environments.
PaperCut doesn't use, bundle, or rely on PHP in any of its products. You may notice sample .php files in the PaperCut NG/MF installation directory under server/examples/webservices/php/. These are inert reference examples for developers working with the XML-RPC API. PaperCut doesn't bundle a PHP interpreter or execute PHP code, so these files pose no risk.
NT-ware confirmed that uniFLOW Online, uniFLOW Server, sysHUB, and their related applications and services don't run PHP. As an extra precaution, NT-ware also patched its external-facing web services by 5:00 p.m. CEST on October 21, one hour after full public disclosure.
*uniFLOW Server Notes
Older uniFLOW Server versions. Versions older than 2023 LTS, 2022v2, 2022 LTS SR1 and 2021 LTS SR6 include a PHP folder (..\Program Files (x86)\uniFLOW\PHP\) for the retired uniFLOW Snapshot Tool. It doesn't run as a web service and can't be exploited, and you can safely delete it.
uniFLOW Internet Gateway. The Internet Gateway reached end of life in 2022 and is affected on the few custom installs still running. NT-ware's guidance is to move off the Internet Gateway to a supported product, such as a hybrid uniFLOW Online setup, rather than patch it. If you're still running it, contact us and we'll help you plan the move.
DocuWare Cloud and DocuWare On-Premises don't use PHP and aren't affected.
Process Fusion confirmed that Infinity Cloud is built on Microsoft .NET and doesn't use PHP in any of its services. Its security team also reviewed Infinity Cloud's hosting infrastructure, supporting systems, and third-party components and found no exposure. Process Fusion's public websites (processfusion.com and uniprint.net) do use PHP and have been patched. Those sites are separate from Infinity Cloud and don't store or process Infinity Cloud customer data.
Laserfiche products don't use PHP. However, Laserfiche Mobile Server installs some .php test files that came bundled with a third-party library. They aren't used to run the server and can be safely deleted. You'll find them in the "dijit" and "dojox" subfolders of <Install path>\Web Files\js-src.
WestFax does use PHP in some systems. Its security tools flagged the issue on the evening of October 20, and WestFax applied interim mitigations before a patch even existed. Patched PHP versions were installed the morning of October 21, as soon as packages became available.
WestFax found no evidence of exploitation, and no client action is required.
Vasion has patched PHP in all Vasion-hosted PrinterLogic services, including FedRAMP, so cloud customers don't need to do anything for PHP2Shell. If you run the PrinterLogic Virtual Appliance on your own network, upgrade it to host 26.2.362 (released October 30), which includes the PHP fix. Vasion also recommends that all customers update their Agent and Service Agent software to address a separate certificate issue (the eMudhra intermediate CA compromise). If automatic updates are turned off, this has to be done manually.
Even if your ProIT-supported products are in the clear, PHP may still live elsewhere in your environment. We recommend the following steps:
For example, a company running PaperCut MF for print management and a PHP-based employee portal would need no changes to PaperCut. The portal, however, should be patched immediately.
Do I need to update any ProIT-supported products because of PHP2Shell?
Only if you run a PrinterLogic Virtual Appliance or the end-of-life uniFLOW Internet Gateway (see above). Every other product is either not affected or already patched by the vendor.
I found .php files on my PaperCut, Laserfiche or uniFLOW server. Should I be worried?
No. These are leftover reference, test or retired files. None of these products runs them, so they do nothing on their own.
Was any customer data exposed?
None of the vendors that have responded reported evidence of exploitation in their product environments.
Erick Miller, our VP of Technology Solutions, is leading ProIT's response to PHP2Shell. His team is staying in close contact with each vendor and tracking new developments as they happen.
The vast majority of the products we support aren't affected, WestFax and Vasion's hosted PrinterLogic services have already been patched. The only customer actions are the PrinterLogic Virtual Appliance upgrade and moving off the uniFLOW Internet Gateway. We'll update this post if anything changes.
If you have questions about your environment or want help reviewing other systems for PHP exposure, reach out to your ProIT account team.