PHP2Shell: Why QliqSOFT Isn't Affected, and How We Checked

QliqSOFT's products and website are not affected by PHP2Shell, the pair of critical PHP flaws that attackers started exploiting in October 2026. Neither uses PHP, and we checked our code, server images and production and development cloud accounts to confirm it. Here is what the flaws are, how we checked, and what to do if you run PHP.

We don't write about every security bug that makes the news. PHP2Shell is an exception for two reasons: it touches a huge share of the web, and even though our products don't use PHP, there's a decent chance something your agency relies on does.

What PHP2Shell is

PHP is a programming language that runs on web servers. It has been around since the mid-1990s and sits underneath WordPress, Drupal, Joomla, Magento and a long tail of custom sites. W3Techs puts it at about 69% of the websites whose server-side language is known.

On October 21, the PHP project released fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed PHP2Shell. The fixes were supposed to come out on the 22nd, but the vulnerability IDs leaked online the day before and the release was moved up.

In plain terms, someone anywhere on the internet can send a specially built web request to a server running an unpatched version of PHP and, under the right conditions, get that server to run commands of their choosing. No password or account is needed. For a website, that can mean the attacker takes it over, plants malware on it, or reads whatever data it handles.

Both flaws are rated 9.2 out of 10 for severity. Amazon's threat intelligence team saw the first attack attempts on October 17, four days before a fix existed. On October 26 the federal Cybersecurity and Infrastructure Security Agency (CISA) added both to its list of vulnerabilities known to be used in real attacks, and gave federal agencies until October 29 to patch.

The attacks aren't easy to pull off yet. Several research teams say the public attack code only works against certain server setups. That's cold comfort, though. Researchers have already reported successful break-ins, and attack code usually gets better fast once a bug like this is public.

There's also a third, related flaw, CVE-2026-115560, that had no fix at the time of writing. It only matters for unusual configurations, and turning off one PHP setting, session upload progress, blocks it until a fix ships.

Why QliqSOFT isn't affected

Our products don't use PHP. That holds for QliqCHAT, Quincy and every other product we make, and for our website, qliqsoft.com.

"We don't use PHP" is an easy thing to say, so my team and I went and checked, four different ways:

1. We searched every active code repository QliqSOFT maintains for PHP files and PHP package lists. There were none.
2. We reviewed the build files for our server images. None of them add PHP.
3. We looked across every region of our production and development cloud accounts for the places PHP tends to turn up, like managed web hosting, WordPress servers and serverless functions. Nothing there runs PHP.
4. We probed our public web addresses from the outside, the way an attacker hunting for PHP servers would. None of them answered as one.

The apps we ship to you, on phones, desktops and Chromebooks, don't contain PHP either. You don't need to update anything from QliqSOFT because of PHP2Shell.

If your organization runs PHP

Plenty of home health and hospice agencies do without thinking of it that way. If your public website is built on WordPress, it runs on PHP. So do a lot of online referral and intake forms, some patient portals from smaller vendors, and the admin screens on some firewalls and VPN devices.

Here's what I'd do in your position:

1. Ask whoever hosts your website or manages your servers to confirm PHP is on version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. Ask them to confirm PHP was restarted afterward, too. Installing the update doesn't protect a server until PHP restarts.
2. If you're on PHP 8.1 or older, plan the upgrade now. Those versions are past end of life and there's no official fix for them. Ask your host how they're protecting the site in the meantime.
3. Ask whether anyone has looked for signs of a break-in. Attacks started before the fix existed, so a site that was patched right away could still have been hit. Investigators recommend looking back to at least October 17.
4. Bring in your privacy officer if the site collects patient information. That includes referral forms, intake forms, and contact forms where a family describes a loved one's condition. If a site like that was broken into, treat it as a possible breach of patient information.
5. Ask your other vendors the question we just answered. The Canadian Centre for Cyber Security specifically warns about PHP built into third-party products and appliances, where you can't see it and can't patch it yourself.

If you have questions about PHP2Shell, or about how we protect your data more generally, email us at support@qliqsoft.com. Our security page has more on our security program.

Sources: Tenable, PHP2Shell FAQ (timeline, severity, fixed versions, and the W3Techs figure); Canadian Centre for Cyber Security, alert AL26-026; Rapid7 analysis; TechCrunch, October 27, 2026.