Summary
Appeon is aware of the recently disclosed PHP2Shell security vulnerabilities (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560), which may allow unauthenticated remote code execution on affected PHP servers.
Appeon has investigated the potential impact on its products and website infrastructure. This bulletin summarizes our findings and the remediation actions taken.
Are Appeon Products Affected?
No versions of PowerBuilder, PowerServer, or InfoMaker are directly affected by these vulnerabilities, as these products do not depend on the PHP runtime.
If a customer's hosting environment includes separate PHP-based applications or services, those components should be evaluated and patched independently.
Appeon Website
Some Appeon websites use PHP, which have been upgraded to PHP runtime environments with the relevant security fixes to address the PHP2Shell vulnerabilities.
Appeon has performed comprehensive assessment and no data breaches or security incidents have been detected.
Recommendations
Customers running PHP-based applications or services should ensure that their PHP environments are updated to versions containing the relevant security fixes.
Customers using Appeon products alongside independently deployed PHP-based components should assess and update those components separately.
Questions?
If you have any questions regarding this security bulletin, please open a support ticket through the Appeon Standard Support portal.
Date: October 26, 2026