×
![]()
Critical PHP vulnerabilities (php2shell) CVE-2026-109618 and CVE-2026-109619
Last updated: 23 October 2026
ITRS has reviewed all product lines and code bases for the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as php2shell. Here is our current status.
| Product | Status | Action required |
|---|---|---|
| OP5 Monitor | Affected | Upgrade your PHP environment |
| Opsview On-Premises | Affected | Upgrade your PHP environment |
| Opsview Cloud | Affected: resolved by ITRS | None |
| Geneos (v7 and earlier) | Not affected | None |
| ITRS Analytics | Not affected | None |
| Uptrends | Not affected | None |
| Ekara | Not affected | None |
| Log Analytics | Not affected | None |
| Capacity Planner | Not affected | None |
Affected: client action required Copied
PHP is not distributed with these products, but they depend on it.
- OP5 Monitor is affected. We’ve tested a PHP upgrade with the product successfully, and clients should upgrade their PHP environment. See OP5 Monitor: PHP security update.
- Opsview Essentials installs php-fpm as a dependency for NetAudit. We’ve tested a PHP upgrade with the product successfully, and clients should upgrade their PHP environment. See Opsview: PHP security update.
Affected: resolved by ITRS Copied
- Opsview Cloud: all affected environments have been upgraded. Clients do not need to do anything.
Not affected Copied
These products don’t use PHP anywhere in their code base, so no releases are planned in response to these CVEs:
- Geneos (version 7 and all earlier versions)
- ITRS Analytics
- Uptrends
- Ekara
- Log Analytics
- Capacity Planner
Questions Copied
If you have any questions, please contact ITRS Support.
["OP5 Monitor", "Opsview On-Premises", "Opsview Cloud", "Geneos", "ITRS Analytics", "Log Analytics", "Capacity Planner"]
["Release Notes"]