Apryse Statement: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
October 22, 2026
On October 21, 2026, the PHP project disclosed two critical vulnerabilities in PHP. These flaws can be potentially misused by bad actors to execute 3rd party code on an affected server without signing in. The PHP project released patched versions the same day.
Apryse has reviewed all of its products. WebViewer, Server SDK, Apryse SDK, PrizmDoc, RasterMaster, ActivePDF, iText, LEADTOOLS, and Scanbot do not use PHP and are not affected.
Xodo Sign uses PHP in its hosted service. All Xodo Sign production-facing PHP services were updated within hours after the official patch release. No action is required from Xodo Sign customers.
PDFlib and TET are not affected. Both include an optional extension module for PHP that utilizes the customer's PHP runtime. Customers who use PDFlib or TET with PHP should update their own PHP installation. No new PDFlib or TET build is required.
We will update this statement as that work is completed.
If you have questions about a specific product, please contact our support team.
Frequently Asked Questions
What are the PHP2Shell vulnerabilities?
Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2. They can let an attacker run code on a server through a crafted web request, without logging in.
Which PHP versions are affected?
All supported versions before the October 21 patch. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Which Apryse products are affected?
Xodo Sign’s hosted service is the only Apryse product that uses PHP, and it has been patched.
Are Apryse licensing or purchasing systems affected?
We are reviewing supporting systems, including licensing and commerce services. We will update this statement if anything else is found.
Was Xodo Sign affected?
Yes. Every service running PHP was affected before the patch. Xodo Sign was patched within hours of the PHP release.
What PHP versions does Xodo Sign run now?
PHP 8.4.27 and 8.2.35. Both are patched releases.
Was any customer data accessed?
Our log review found no signs of attempted misuse. We also monitor for and block malicious activity.
Do Xodo Sign customers need to do anything?
No. No action is required from Xodo Sign customers or third-party integrations.
I use Eversign. Does this apply to me?
Yes. Eversign is now Xodo Sign, and the same answers apply.
I use PDFlib or TET with PHP. Am I at risk?
PDFlib and TET are not affected. The vulnerabilities are in PHP itself, which runs in your environment. Update your PHP installation to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Do I need a new PDFlib or TET build after updating PHP?
No. Your existing PDFlib or TET extension module will continue to work with the patched PHP version.
I use PDFlib or TET with C, Java, .NET or another language. Am I affected?
No.
I use hosted PrizmDoc (PAS). Is that affected?
No. PrizmDoc does not use PHP, and hosted PrizmDoc runs the same software.
My own systems run PHP. What should I do?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The PHP project states there is no complete workaround, so updating is the only safe fix.
Where can I get more help?
Contact Apryse support through the portal and reference your product and license.