22 Oct 2026

This article describes Revenera's position regarding two critical vulnerabilities in PHP web runtimes commonly referred to as "PHP2Shell": CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.

The Flexera Security team completed its assessment of the identified assets. This advisory reflects the final status of that assessment, and no further action is required.

Revenera Usage Intelligence

No publicly accessible PHP execution paths remain on the reviewed systems related to the reported vulnerability.

FlexNet Operations Cloud

FlexNet Operations Cloud is not exposed to these vulnerabilities. A software bill of materials review identified no PHP-related dependencies in the product, and the PHP files found during scanning are static demonstration content with no PHP runtime or request handler present. 

On-Premises Products

Investigations have not identified any Revenera components used on customers' premises that are exposed to these vulnerabilities. 

Protections in Place

Revenera-hosted environments are protected by a Web Application Firewall, which has been updated with detections designed to identify and block exploitation attempts associated with these vulnerabilities. Product Security and Engineering have completed their validation of the underlying systems and product components. The investigation is now complete, and no further action is required. 

Further Questions and Updates

Customers with questions about a specific Revenera product or deployment should contact Revenera Support.