Summary
Appeon is aware of the recently disclosed PHP2Shell security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which may allow unauthenticated remote code execution on affected PHP servers.
Appeon has investigated the potential impact on its products and website infrastructure. This bulletin summarizes our findings and the remediation actions taken.
Are Appeon Products Affected?
No versions of PowerBuilder, PowerServer, or InfoMaker are directly affected by these vulnerabilities, as these products do not depend on the PHP runtime.
If a customer's hosting environment includes separate PHP-based applications or services, those components should be evaluated and patched independently.
Appeon Website
Some Appeon websites use PHP and were potentially affected by these vulnerabilities.
Appeon has completed upgrading the PHP runtime environments used by its websites and applied the relevant security fixes to address the PHP2Shell vulnerabilities.
The remediation work has been completed, and the affected website environments have been updated.
Recommendations
Customers running PHP-based applications or services should ensure that their PHP environments are updated to versions containing the relevant security fixes.
Customers using Appeon products alongside independently deployed PHP-based components should assess and update those components separately.
Questions?
If you have any questions regarding this security bulletin, please open a support ticket through the Appeon Standard Support portal.
Date: October 26, 2026