PHP2Shell: our systems are patched
On October 21, 2026, the PHP project disclosed PHP2Shell, two critical flaws in PHP. We checked everything we host for our clients: the fixed PHP is in place, the hosted POS included, and we found no sign that anyone got in.
What happened
PHP is the programming language that many websites and online systems run on, among them the hosted POS our pharmacies use and the client websites we host. On October 21, 2026, the PHP project disclosed two flaws in PHP itself, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
Both are rated critical: they can let an attacker on the internet run their own commands on a server, without signing in. Security companies reported attacks the same day.
What we checked
Everything we host: the hosted POS for every pharmacy on it, the client websites we run, and this website, which has no PHP in it at all.
Radiance Store isn't built on PHP, so PHP2Shell doesn't affect it.
What we found
Our host had the fixed PHP in place within a day of the announcement, on every PHP version our systems use, the hosted POS included. Everything that runs PHP has restarted on the fixed version, so nothing is still running the old one.
PHP's upload-progress feature, the confirmed way in for one of the two flaws, is switched off where our systems run.
We also looked for signs that anyone got in before the fix: program files that changed, program files in folders meant only for uploads, and scheduled tasks we didn't set up. Every change we found was one of our own updates. There was nothing else.
What you need to do
Nothing. Your POS, its data and your website stay as they are, and you sign in the same way.
We never ask for a password by email, text or Messenger. A message about PHP2Shell that asks for one, or asks you to install something, isn't from us.
Questions
Ask us anything about this: email hello@radianceph.com, or message us on Messenger (opens in a new tab).