Vulnerability Alert
PHP Runtime Vulnerabilities (PHP2Shell)
Severity: Not affected
Date: October 29, 2026
Products: Bravura Security Fabric 12.7, 12.8, 12.9 and 12.10, and Bravura Safe.
CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560 PHP Remote Code Execution
No Bravura Security product update is required. Bravura Security has been alerted to vulnerabilities in the PHP language runtime. Bravura Security Fabric and Bravura Safe do not use PHP and do not include a PHP runtime.
Issue
On October 21, 2026, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. They allow an unauthenticated attacker to run code remotely on servers that run PHP and handle network requests, including PHP-FPM and Apache with mod_php. Exploitation has been seen in the wild, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026. The fix is an updated PHP runtime: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
On October 23, 2026, PHP also disclosed CVE-2026-115560. It is a code-execution issue that affects only some PHP session configurations, and PHP has not released a patch for it yet. Bravura Security products are not affected by it, for the same reason given below.
The PHP project rated CVE-2026-109618 and CVE-2026-109619 at 9.2 (Critical) under CVSS 4.0 for PHP itself. This score does not apply to Bravura Security products.
Affected Versions
We reviewed the source code, installers and container images for Bravura Security Fabric 12.7, 12.8, 12.9 and 12.10, and for Bravura Safe. None of them contain PHP code or ship a PHP runtime. So they are not affected by vulnerabilities in the PHP runtime, including CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560.
Bravura Security Fabric runs on Windows with IIS and native code. The Guacamole remote desktop gateway is a Java application on Apache Tomcat. The product installation guide already states that no ASP, JSP or PHP is used and that these interpreters should be disabled on the product server.
Bravura Safe runs on .NET, Node.js and nginx. It does not use PHP.
Older versions of Bravura Security Fabric are not expected to be affected but were not explicitly investigated.
Remediations
No patch from Bravura Security is required.
- PHP installed on a Bravura Security Fabric server: it is not used by our product. We recommend that you remove or disable it, as the installation guide advises.
- PHP needed for another application on that server: update PHP to a fixed version.
If PHP is not installed on your Bravura Security servers, you do not need to do anything.
Mitigations
None required for Bravura Security products.
Questions
For further questions about this advisory, please reach out to support@bravurasecurity.com.
Acknowledgments
We are committed to ensuring the security of our users. Bravura Security thanks the community and researchers who contribute to the security of our software.