GlobalSuite Solutions’ response to the PHP “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Published on 22 October 2026
Summary. We have updated all production environments of GlobalSuite GRC and the Whistleblowing Channel, as well as our corporate website, with the fixed versions of PHP.
What happened. On 21 October, the PHP project released urgent security updates for two critical vulnerabilities in the core of the language, rated 9.2 on the CVSS scale. These vulnerabilities could allow an attacker to execute code on affected servers without authentication. Their early disclosure led cybersecurity agencies in several countries to recommend patching immediately.
How we responded. We activated our critical vulnerability management procedure, aligned with Spain’s National Security Framework (ENS) and ISO/IEC 27001, as soon as the first advisories were published. We identified all affected components, prepared an emergency deployment and stepped up monitoring through our Security Operations Center (SOC). After validating the fix released by the PHP project, we deployed it to all production environments on 21 October 2026 at 19:00 CEST (17:00 UTC), with no service interruption. We then verified that the fixed version is running on all systems.
Current status. As of the date of this publication, we have found no evidence of exploitation or of unauthorized access to our systems or to our customers’ data. We continue to apply enhanced monitoring and ongoing review of activity, and will implement additional measures should official guidance recommend them.
What our customers need to do. Customers of our cloud services do not need to take any action. For On-Premise and Appliance deployments, the update must be applied to each installation; our support team is contacting each customer to assist them with the process, which we recommend completing as a priority.