CETA’s response to the php2shell PHP vulnerabilities

You may have seen news coverage of two critical PHP vulnerabilities, known as php2shell and tracked as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities affect organisations worldwide that run PHP-based systems, and we want to explain how we have responded on behalf of our iCFM customers. 

Early awareness

Our team became aware of the threat early on Wednesday 21 October, before the official announcement was published. We immediately began reviewing our logging and configuration across the iCFM platform so that we were ready to act as soon as fixes became available.

Rapid, controlled patching

As soon as the vendor patches were released, we deployed them across the platform in a controlled but rapid manner, verifying each stage before moving to the next. Patching is now complete.

Defence in depth

Patching is only one layer of our protection. All traffic to iCFM passes through an enterprise-grade security layer that filters and inspects requests before they reach our servers, alongside our own security controls. This layered approach means we do not rely on any single safeguard to keep customer data safe.

No evidence of compromise

Our review of the platform logs has found nothing to suggest any compromise prior to the patches being applied. We are continuing to monitor closely, both for any activity related to these vulnerabilities and for anything else unexpected.

 Our commitment

As an ISO 27001 certified organisation, we treat the security of our customers’ data as our highest priority. If you are an iCFM customer and have any questions, please contact your usual CETA representative or our support team