27.10.2026 - Maventa is not affected by the PHP vulnerabilities disclosed on 21 October 2026

Dear customers,

Maventa's services are not affected by the PHP vulnerabilities disclosed on 21 October 2026. Maventa's services do not use PHP, so no patching is required and the services are not at risk. Invoices and documents can be sent and received as usual.

The vulnerabilities are known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language widely used in websites and web applications, and the vulnerabilities affect systems that run it.

No action is required in Maventa. Organisations that use other systems or websites built with PHP are advised to check with their IT team or service provider whether those systems are affected.

Maventa monitors security advisories continuously and acts quickly if a vulnerability affects its services.