Security Notice: PHP2Shell

systems@work Software Is Not Affected

On 21 October 2026 the PHP project released emergency security updates for two critical vulnerabilities in the PHP core interpreter, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell". Both are rated 9.2 (CVSS v4.0) and can allow an unauthenticated attacker to execute code remotely on unpatched web servers running PHP.

systems@work software is not affected.

time@work, expense@work, forms@work and invoices@work do not use PHP. There is no PHP runtime in our application stack or in the Microsoft Azure environment that hosts our cloud service. Customers do not need to take any action on systems@work software as a result of these vulnerabilities.

Recommended Action for Other Systems

We recommend customers review the rest of their IT estate, including web servers, content management systems such as WordPress, Drupal and Joomla, and any third-party applications. Where PHP is in use, apply the patched releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or your vendor's updated packages without delay.

Further Information

We continue to monitor the situation. If you have any questions, please contact your usual systems@work support contact or get in touch with us.