PHP vulnerabilities: iCore products and services are not affected

On October 20, details of two critical vulnerabilities in PHP were leaked before they could be disclosed as planned. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to execute code remotely on servers running PHP, without having to log in first. The PHP project rates both as critical and released updated versions on October 21.

Are iCore products affected?

No. We have reviewed our products, services and operating environments, and none of them use PHP. This applies to:

• iCore Integration Suite, including iCore Cloud, iCore On-premise and iCore Hybrid
• iCore Portal and applications such as Application Integration Map (AIM)
• Our managed services and the customer environments we operate
• Our websites, including our documentation sites

The iCore platform and the environments we operate run on Windows and .NET, and our installation and deployment scripts do not install PHP.

As an iCore customer, you therefore do not need to take any action with regard to iCore.

For customers running iCore On-premise or iCore Hybrid

The iCore platform does not use PHP, but other software in your environment might. PHP is often included in web applications, content management systems such as WordPress, control panels and third-party tools. We recommend that you review your environment and update any PHP installations to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as possible. PHP 8.1 and earlier no longer receive official updates.

More information is available in the PHP security advisory.

Questions?

If you have questions about this or any other security matter, please contact our support team:

Email: support@icore.se
Phone: +46 31 773 84 90