Skip to content
  • There are no suggestions because the search field is empty.

2026-10-21: Information about the PHP vulnerability for customers with self hosted Security Centers (PHP2Shell)

This article will be updated continuously for our customers using on-prem deployment of our platform.

Updates:

For further updates related to the PHP2Shell vulnerability test, we refer to this article.

  • 2025-10-23, 11:06 CET: A patch has been available since yesterday for the on-prem core machine, and all standard systems have been patched before 5 pm CET the same day (2026-10-22). To validate that you have the updated version go to on-prem admin > Updates, here "Current version" should be 2.2.3.
  • 2026-10-23, 09:57 CET: We have merged the two vulnerability tests (HID-2-1-5412933, and HID-2-1-5412942) into one with HID HID-2-1-5412933.
  • 2026-10-22, 13:51 CET: Clarification, it can take up to 24 hours before the vulnerability test are available for all Scanner Appliances. Read about how to scan for this vulnerability.
  • 2026-10-22, 11:31 CET: Two tests are now available that can be used for unauthenticated and authenticated scanning (HID-2-1-5412933, and HID-2-1-5412942). We're still working on a patch for the on-prem core machine for customers using on-prem deployment.
  • 2026-10-22, 08:45 CET: We're working on a patch for the core machine for our on-prem customers. More updates will follow during the day.
  • 2026-10-21, 22:25 CET: We're working on a patch for the core machine for our on-prem customers.

Am I using on-prem?
On-prem deployment is when the customer has a self-hosted version of our platform, with a core machine installed from which our portals (Security Center, Organizer, and Back Office) are delivered. Customers using cloud deployment and possibly locally installed Scanner Appliances are not concerned by the information regarding on-prem. 

Background

PHP2Shell - a critical vulnerability in PHP 

Critical vulnerabilities have been found in PHP, a scripting language used in our platform. They are tracked as CVE-2026-109618 and CVE-2026-109619 and score 9.2 out of 10 (critical) on CVSS v4.0. Read more about this vulnerability.

Impacting customers using on-prem deployment 

Vulnerable PHP versions are used in on-prem, impacting the interfaces Security Center, Organizer, and Back Office.

Customers using cloud deployment

If you're a customer using our cloud platform, you don't need to take any action as it's already patched and remediated. 

Ensure there's no access over internet

If you run Holm Security on-prem, please act now. Block internet access to your on-premises installation until the patch is out. Only allow access from your internal network or VPN.

We will release a fix for the latest version of on-prem as soon as possible. We will reach out to you via email with more information when the update is available.

Take actions

Scan for PHP2Shell

    Read about how to scan for this vulnerability.

    Find vulnerable PHP applications 

    Read about how to find vulnerable PHP applications, without scanning.