No impact incident

ISL Online: PHP vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

Current status of ISL Online: Operational — live ISL Online status

Timeline

1. Oct 21, 2026, 15:30 UTC
   resolved
   Update on the recent PHP vulnerabilities You may have seen news about two newly disclosed critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Here's an update on how they relate to ISL Online. The ISL Online product is not affected. ISL Light, ISL AlwaysOn and the ISL Online servers that carry remote-support sessions do not use PHP. All services are running normally, with no interruption. ISL Online website: PHP is used only on our public website and licensing web servers, which handle the website, the account portal and the shop. Before a fix was available, we locked down the firewalls on those servers so that only Cloudflare and our own infrastructure can reach them. As soon as the security update for our server platform was released, we applied it to all of these servers within an hour. The website stayed available throughout. No action is needed on your end. Your sessions, devices and settings are not affected, and you don't need to update anything.

Updates as published by ISL Online (original).