RMS is not affected by the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell", because RMS applications and the RMS platform do not use PHP.
Status: No impact on RMS services
Last updated: 23 October 2026
About the PHP2Shell Vulnerabilities
The PHP2Shell vulnerabilities are two critical security flaws in PHP, a scripting language that many websites and web applications run on. They were disclosed on 21 October 2026 and are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) on version 4.0 of the Common Vulnerability Scoring System (CVSS). They could allow an unauthenticated attacker to run code remotely on a server that runs an unpatched version of PHP.
Is RMS Affected by the PHP2Shell Vulnerabilities?
The RMS Office of Cyber Security (ROCS) has assessed the PHP2Shell vulnerabilities and confirmed the following:
- RMS applications and the RMS platform do not use PHP and are not affected.
- All RMS services are operating normally.
- ROCS continues to monitor the situation.
Third-Party Service Providers
RMS is working with its third-party service providers to confirm whether any of their systems use PHP and, where they do, that the providers have applied the relevant fixes. This review is ongoing, and RMS will update this article as it receives confirmations.
What to Do If You Run PHP
The PHP2Shell recommendations apply only if you run PHP on your own websites or servers, not to your use of RMS. If you run PHP, update to a fixed release as soon as possible:
- PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release in the same series.
- PHP 7.4 to 8.1 has no official fixed release. Use your vendor's patched package or ask your hosting provider.
If a provider or agency manages your website, ask them to confirm that they have applied the fix.
Further Information
For more detail on the PHP2Shell vulnerabilities, see the Australian Cyber Security Centre alert Critical vulnerabilities in PHP. For information on RMS security policies and controls, visit the RMS Trust Centre.
Comments
0 comments
Please sign in to leave a comment.