We have received questions about the latest PHP security advisory from Germany’s Federal Office for Information Security (BSI). In response, we reviewed the current SupraWorx source code and the deployment configuration on record. Based on that review, the SupraWorx application is not directly affected by the two reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Technical background
SupraWorx is built on Python and the Django web framework. The application configuration we reviewed does not use a PHP runtime to process requests. The recently reported vulnerabilities affect PHP installations that process web requests.
These vulnerabilities, also known as “PHP2Shell”, can allow malicious code to be executed on affected systems without prior authentication. The BSI has published a security advisory. The PHP project has made security updates and technical guidance available since 21 October 2026.
What does this mean for SupraWorx users?
Based on the current assessment, no additional action is required in relation to these two vulnerabilities for users of the SupraWorx application itself.
This assessment applies to the application and configuration as reviewed. It does not cover separately operated PHP websites, custom extensions or connected third-party products, which must be assessed separately. ENISA also notes that PHP may be embedded in other products. Operators of those products should follow the relevant vendor guidance and install any required security updates.
