Security notice

Two critical flaws in PHP, and why they do not reach the platform

On October 21, 2026 the PHP project released fixes for two critical vulnerabilities in the PHP core, known together as "PHP2Shell". The Thinger.io platform is not affected: no component of it runs PHP.

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on web servers that run PHP. Both are rated 9.2 (CVSS v4.0), they affect nearly every PHP version of the last decade, and attack traffic against them has already been reported. If you run PHP anywhere, it is worth patching today.

PHP2Shell at a glance

CVEs
CVE-2026-109618, CVE-2026-109619
Severity
Critical, CVSS v4.0 9.2
Impact
Unauthenticated remote code execution
Fixes released
Patched PHP
8.5.128.4.278.3.368.2.35
Thinger.io platform
Not affected

Our platform

Why is Thinger.io not affected?

The flaws live in the PHP interpreter. There is no PHP interpreter anywhere in the platform.

A native server

The Thinger.io server is native software written in C++. It does not run on PHP or on any web scripting runtime.

A static console

The console is a web application delivered as static files by that same server.

Every edition, the same core

Thinger.io Cloud, private instances and on-premise installations run the same server, packaged as containers that do not include a PHP interpreter.

A static website

The thinger.io website is a static site: there is no PHP, and no application server, behind it.

Full transparency

The one place where we use PHP

The only service in our infrastructure that uses PHP is the tool that sends this newsletter.

It runs apart from the platform, holds only the newsletter mailing list, and has no access to accounts, devices or data. It has already been patched. The subscription form on the website does not talk to it directly either: it goes through our forms API, behind a bot check.

Running your own server

What if Thinger.io runs on my own server?

The platform needs no action. The rest of the machine might.

If other software on the same host uses PHP (a CMS, a database admin panel, a monitoring tool), update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to the patched package of your distribution. Branches 8.1 and older may not get a fix, so check with your vendor.

Until you can update, disabling session.upload_progress.enabled blocks the known attack path for one of the flaws, though not every variant. It is a stopgap, not a fix.

Questions

Talk to us

If your security team needs a statement for its records, or you have any question about this notice, write to security@thinger.io.