SolutionsPT statement regarding PHP security issue:
You may have seen that a vulnerability in PHP has recently been discovered. This has been logged as CVE-2026-109618 and CVE-2026-109619.
- CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
You can find more details from the UK and Ireland Cyber Security agencies here:
SolutionsPT is a product distributor, we do not create and maintain our own products. Instead, we distribute products on behalf of other companies, we sometimes also design and build solutions using them. Below is a list of the major hardware and software vendors that we work with both directly and indirectly via other parties. Please note that this list is not exhaustive and will be expanded when we receive further responses. We have compiled either a web link or a statement about the PHP vulnerability which you can use to review your solutions against. This is a fast-moving event so please check back frequently.
You are advised to follow the application software vendor's guidance in remediating this problem. When application patches from vendors are made available, you should consider installing them as soon as possible following your usual patching procedures.
You should consider taking the following precautions:
- Ensure that your business continuity plan is up to date.
- Ensure that you have up to date backups of your systems, particularly before applying patches or other remediation steps.
- Where network monitoring is deployed, e.g. Claroty CTD, Tenable etc. or you have signature-based end point protection installed, you should ensure that it is operating correctly and you have installed the latest threat updates for it.
If you have any questions or require any help you can contact our Support team on +44 (0)161 495 4640.
Supplier statements are available below:
Advantech – Awaiting statement. Advice is to check their website.
AVEVA – AVEVA Confirmed there are currently no known affected Products.
Arctic Wolf – Arctic Wolf have not provided a specific statement regarding their own product however they have released the following general advisory regarding the PHP vulnerability:
Belden – Two Belden products are affected however they are not provided by SolutionsPT.
Claroty - Claroty products do not utilize PHP and remain unaffected.
Cyolo – Currently awaiting statement. Our advice is to check their website.
Datto (Proteus) – Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. There is currently no customer action required.
Dell - A Dell product has been identified as being impacted however it is not provided by SolutionsPT. Dell recommends customers to follow best practices and continue to monitor their website for updates.
Kepware – Awaiting statement. Our advice is to check their website.
Ultimo by IFS – Ultimo products do not utilize PHP and remain unaffected.
ProcessVue – ProcessVue products do not utilize PHP and remain unaffected.
Poka (Teamwork) – Poka products do not utilize PHP and remain unaffected.
Rockwell (ThinManager) – Rockwell confirmed this does not apply to their products.
Stratus – Awaiting statement. Our advice is to check their website.
Tenable – Tenable Security Center and Tenable Enclave Security do include PHP. Out of caution, Tenable released stand-alone security patch SC-202610.1 for both products on October 22. It updates PHP to 8.2.35. Details are available in TNS-2026-28 for Tenable Security Center and TNS-2026-29 for Tenable Enclave Security, and advisories for Tenable products are published at tenable.com/security.
Timeseer – Timeseer products do not utilize PHP and remain unaffected.
Please contact our Technical Support team if you require any help or further information.
