Important Information: SpareParts365 Is Not Affected by the Current PHP2Shell Security Vulnerabilities

There have been recent reports in the public sphere and in the media regarding two critical security vulnerabilities in the PHP programming language, which have become known as PHP2Shell. These vulnerabilities are listed, among others, as CVE-2026-109618 and CVE-2026-109619 and, under certain conditions, allow malicious code to be executed on web servers. Numerous PHP-based applications and systems are affected.

We would like to inform you that our SpareParts365 system is not based on PHP and is therefore not affected by these security vulnerabilities. The known attack vectors—particularly those related to the PHP session upload progress indicator and memory management—do not apply to our software. No action is required on your part regarding SpareParts365.

We are closely monitoring further developments and will, of course, keep you informed should any relevant findings emerge. Further information on the security vulnerabilities known as PHP2Shell can be found in the official advisories from the PHP Foundation and CERT-EU, as well as under the keyword “PHP2Shell.”

Please note that this statement applies exclusively to SpareParts365. For other systems you use, we recommend that you review the official advisories and, if necessary, inform your IT administrators.

Please feel free to contact us if you have any questions.