SOLO Server is not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
SOLO Server and the SoftwareKey licensing clients are not affected by CVE-2026-109618 and CVE-2026-109619, the critical PHP remote code execution vulnerabilities announced in October 2026 (also called PHP2Shell). SOLO Server does not use PHP, so there is nothing to patch and no action is needed for your SOLO Server account.
What are CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 and CVE-2026-109619 are flaws in the PHP interpreter itself. They allow an unauthenticated attacker to run code on a server that uses PHP to handle web requests. Only systems that run PHP are exposed. Details are on the National Vulnerability Database pages for CVE-2026-109618 and CVE-2026-109619.
Why is SOLO Server not affected by the PHP vulnerabilities?
SOLO Server is built on Microsoft ASP.NET and runs on Windows Server, Microsoft IIS, and Microsoft SQL Server, as listed in the SOLO Server System Requirements. SOLO Server does not include, use, or require PHP. This applies to every way you can use SOLO Server: the Shared URL, Custom URL, and Dedicated URL services that SoftwareKey hosts, and self-hosted installations.
Are the Protection PLUS 5 SDK and Instant Protection PLUS 3 affected?
No. The licensing libraries you build into your application, the Protection PLUS 5 SDK (PLUSManaged and PLUSNative) and Instant Protection PLUS 3, do not contain PHP. Applications protected with SoftwareKey licensing do not need an update for these PHP vulnerabilities.
Do I need to do anything?
You do not need to do anything for your SOLO Server account or your protected applications. Two situations involve PHP that you manage yourself:
- You call the SOLO Server web services (API) from PHP. If your website, store, or back-office system uses PHP code to create licenses or look up customers through the SOLO Server web services, that PHP installation runs on your server and needs the PHP security update. SOLO Server itself is not affected.
- You self-host SOLO Server and installed PHP on the same server for another application. SOLO Server does not need PHP, so update PHP for that other application or remove it.