en
Support
Status
Shop
The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026, do not affect verinice. Neither the new generation of verinice nor verinice Classic uses PHP.
Two critical vulnerabilities in the PHP runtime environment are grouped under the name ‘PHP2Shell’. Both have a CVSS 4.0 score of 9.2. Attackers can exploit these to execute code on vulnerable web servers without authentication. The BSI has issued a Level 3 / Orange cyber security alert (BITS-H No. 2026-297981-1032).
No verinice variants affected
This applies to all current and older variants:
- verinice.cloud
- verinice.onprem
- verinice.PRO
- verinice Single-user
verinice does not contain any PHP whatsoever. The vulnerabilities lie within the PHP interpreter itself; where it is not running, there is no attack surface. This also applies to other PHP vulnerabilities reported in connection with PHP2Shell.
Regardless of the specific application: our websites and online shops have already been updated to secure PHP versions.
What you should do
verinice.cloud: No action required; SerNet will handle this for you.
verinice.onprem and verinice.PRO: No action is required on the verinice server itself. If other PHP applications are running on the same machine, please check their PHP version. The vulnerabilities have been fixed in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For older PHP branches, please refer to the guidance provided by your Linux distribution.
verinice single-user version: No action required.
The BSI warning with updated recommendations: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf
For further enquiries, please contact verinice Support at support@verinice.com or on 0551 370000-0.
