Security notice: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

 

Status: 22 October 2026

Summary

  • TKI products do not use PHP. They are not affected by PHP2Shell.
  • The only affected system was a legacy instance of Autodesk Infrastructure Map Server (AIMS). A part of its web front end ran on PHP. We fully shut down this front end on 22 October 2026.
  • We ran a full scan of all servers that we operate. No server has PHP installed.
  • The access logs of the system go back to 2024. They contain no request to the PHP components. Thus we have no indication that the vulnerabilities were exploited.

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in the PHP scripting language. The PHP project disclosed and fixed them on 21 October 2026.

  CVE-2026-109618 CVE-2026-109619
Type memory corruption after an out-of-memory abort stale global state (use-after-free)
Impact code execution with the rights of the web server code execution; reading memory of the PHP process
Authentication required no no
Rating CVSS v4.0: 9.2 (critical) CVSS v4.0: 9.2 (critical)

The defects are in PHP itself, not in a specific application. Every PHP installation that serves web requests is affected, for example PHP-FPM, Apache with mod_php, and php-cgi. Through CVE-2026-109619, an attacker can also read memory of the PHP process, for example session data or credentials of other requests.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older, only source backports are available (7.4, 8.0, 8.1). The PHP project states that only the update is a complete fix; configuration changes close only some attack paths.

What does this mean for TKI products?

Our products, for example NET, NET Cloud, NET Mobile and NET Scan, do not contain PHP and do not need PHP. They are not affected. You do not have to do anything for these products.

What was affected and what did we do?

We still operated a legacy instance of Autodesk Infrastructure Map Server (AIMS) that was reachable from the internet. The back end of this instance ran on ASP.NET, a part of the web front end on PHP. This PHP part was affected by PHP2Shell.

We did these steps:

  1. We fully shut down the web front end of the AIMS instance on 22 October 2026.
  2. We ran a full scan of all servers that we operate. No server has PHP installed.
  3. We examined the access logs of the system back to 2024. Since 2024, there was no request to the PHP components. An attack through PHP2Shell requires such a request.

An external service provider operates our company website on infrastructure that is fully separate from our systems. The provider has installed the PHP security updates.

What do you have to do?

  • As a user of our products: nothing.
  • If you operate Autodesk Infrastructure Map Server or MapGuide yourself: These products ship PHP for their web components. Autodesk no longer develops AIMS, so do not expect an update from the vendor. Check if PHP is installed on your server and serves web requests. If yes, shut down the PHP components or disconnect the server from the internet. We can help you with this.
  • For other PHP applications in your organization: Update PHP to one of the versions above and restart all PHP processes.

Contact

If you have questions, contact our support at support@tki-chemnitz.de.

Sources