Are Liquidware products affected by the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619?
On October 21, 2026, the PHP project released security updates for two critical remote code execution vulnerabilities in the PHP engine, publicly known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). This article explains what the vulnerabilities are and confirms the status of Liquidware products.
ProfileUnity, FlexApp, FlexApp One, Stratusphere and CommandCTRL do not include, ship or run the PHP runtime. No Liquidware patch or configuration change is needed.
📄 Contents
Vulnerability Summary
Both vulnerabilities are in the PHP engine itself, not in a PHP application or framework. They can allow unauthenticated remote code execution on web servers that run PHP. The PHP project rates both at CVSS v4.0 9.2 (Critical). Risk is highest for servers that run PHP as an Apache module (mod_php), and PHP-FPM deployments are also exposed.
| CVE | Description | CVSS v4.0 |
|---|---|---|
| CVE-2026-109618 | RCE through out-of-memory corruption. Out-of-memory handling can interrupt PHP while request data is only partly initialized, and request cleanup may then treat invalid data as valid. | 9.2 Critical |
| CVE-2026-109619 | RCE through stale global state. State owned by one request can outlive its freed memory and be used by a later request on the same PHP worker before it is reset. | 9.2 Critical |
The PHP project fixed both vulnerabilities in the following releases. Minimal backports were also published for PHP 7.4, 8.0 and 8.1.
| PHP Branch | Fixed Version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (PHP 8.2 reaches end of life on December 31, 2026) |
Liquidware Product Status
| Product | Uses PHP | Status | Action Required |
|---|---|---|---|
| ProfileUnity (Management Console, Client, License Server) | No | ✓ Not Affected | None |
| FlexApp (including FlexApp Packaging Console and FlexApp Packaging Automation) | No | ✓ Not Affected | None |
| FlexApp One | No | ✓ Not Affected | None |
| Stratusphere FIT and Stratusphere UX (Hub, Database, Collector appliances and Connector ID Key) | No | ✓ Not Affected | None |
| CommandCTRL (cloud service and agent) | No | ✓ Not Affected | None |
Why Liquidware Products Are Not Affected
These vulnerabilities can be exploited only where the PHP runtime handles web requests. No Liquidware product includes, installs or depends on PHP:
- ProfileUnity and FlexApp are built on Microsoft .NET. The ProfileUnity Management Console uses MongoDB as its database.
- Stratusphere appliances serve their web interface from Apache Tomcat (Java), with PostgreSQL as the database.
- CommandCTRL, including its cloud service and the endpoint agent, does not use PHP. No customer action is needed for the CommandCTRL service or agent.
- The Liquidware management consoles and web interfaces are not built on PHP, and no Liquidware installer deploys
mod_php, PHP-FPM orphp-cgi.
Recommendations for Your Environment
Liquidware products need no action. The PHP project and security researchers still treat these vulnerabilities as urgent, so review the rest of your environment:
- Find PHP servers. Look for any web server, appliance or container that runs PHP, including servers that share infrastructure with your ProfileUnity or Stratusphere deployment.
- Update PHP. Install the fixed PHP release for your branch (see the table above), or your Linux distribution's patched package, then restart the web server or PHP-FPM service. The PHP project says that updating is the only complete fix. Mitigations reduce exposure but do not make an installation safe.
- Check vendor advisories. For third-party products that bundle PHP, follow that vendor's guidance.
FlexApp delivers applications exactly as they were packaged. If you have packaged an application that includes its own PHP runtime (for example, a local development stack or a line-of-business application with a built-in PHP web server), that package carries the PHP version it was built with. Update the application to a release that includes a fixed PHP version and repackage it, or apply the update in a new package version. This applies to the packaged application, not to FlexApp itself.
References
- PHP.net release announcements (October 21, 2026 security releases)
- GHSA-w8hw-w9fx-j79w — CVE-2026-109618
- GHSA-6wmf-4rv5-p3rp — CVE-2026-109619
- Wiz Research: PHP2Shell
If you have questions about this article or about Liquidware product security, contact Liquidware Support.
| Product | Liquidware ProfileUnity, FlexApp, FlexApp One, Stratusphere FIT, Stratusphere UX, CommandCTRL |
| Applies To | All versions |
| Severity | Informational |
| Updated | October 21, 2026 |