SoftActivity
MONITORING SOFTWARE BLOG
Home » Blog » News and product release history

PHP2Shell (CVE-2026-109618, CVE-2026-109619): SoftActivity products are not affected

Short answer: SoftActivity’s on-premise and cloud monitoring software is not affected by the PHP vulnerabilities known as PHP2Shell. This applies to current and older versions. You don’t need to do anything.

What happened

On October 21, 2026, the PHP project released security updates for two critical flaws in PHP, a programming language that many websites run on. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are known together as PHP2Shell. On a web server running an affected version of PHP, an attacker could take control of the server without signing in. PHP versions 5.4 through 8.5 are affected. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. See the PHP project’s security advisory for details.

Is SoftActivity affected?

No. Our on-premise and cloud monitoring software doesn’t include or use PHP.

  • SoftActivity Monitor (on-premise), including the web console you host on your own server: not affected. It doesn’t include PHP.
  • TS Monitor (terminal server edition), including the web console: not affected. It doesn’t include PHP.
  • SoftActivity Work (cloud): not affected. The cloud service and the app on your computers don’t use PHP.

None of these need any action from you.

Older versions

Older versions of our on-premise software don’t include PHP either, so they are not affected by PHP2Shell.

We still recommend the latest version

Each SoftActivity release includes security fixes and updated components that help protect you from other vulnerabilities. The latest on-premise version is 15.4, released in September 2026. Get the latest version.

Your license keeps working with the version you have. To install new versions, you need an active Updates & Support Plan. If yours has expired, you can renew it at any time.

We update the cloud service ourselves, so cloud customers always have the current version.

If you run your own PHP websites

Many organizations run PHP on other servers, such as an intranet or a company website. If you do, update PHP to a fixed version as soon as you can, or ask your hosting provider to confirm they have.

Questions

Do I need to update SoftActivity because of PHP2Shell?

No. SoftActivity’s on-premise and cloud software doesn’t use PHP. We still recommend the latest version for its other security fixes.

Is the on-premise web console affected?

No. The web console doesn’t include or use PHP, in current or older versions.

Where can I get help?

Contact our support team. We’ll update this page if anything changes.

October 22nd, 2026