CERT-FR and CERT-EU recently published advisories about two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, also known as “PHP2Shell”. CERT-EU rates them 9.2. An unauthenticated remote attacker could use them to run arbitrary code on an affected server.

TSplus products are not affected

No TSplus software installed on your servers or workstations includes or relies on PHP. Your TSplus deployments are not exposed to these vulnerabilities.

Regarding our online websites and services

All TSplus instances we identified as vulnerable have now been patched. Licensing, downloads and all other TSplus online services are running normally.

TSplus development team immediately reviewed every TSplus web service that could be exposed:

• Corporate websites (tsplus.net and regional sites): these sites are statically generated and do not run PHP, so they were never exposed. As a precaution, we also updated the PHP components on their supporting infrastructure on Friday, October 23.

• Licensing portal (license.tsplus.net): we disabled the at-risk features as soon as the advisory came out, then updated PHP on Friday, October 23.

• TSplus Academy (academy.tsplus.net): PHP was updated on Friday, October 23.

• Download servers (dl-files.com): PHP was updated today, Tuesday, October 27.

If you run PHP on your own infrastructure

We recommend that you follow the CERT-FR guidance:

• Upgrade to a patched PHP release (8.2.35, 8.3.36 or later). End-of-life branches such as PHP 8.1 will not receive a fix.

• Until you can upgrade, disable session.upload_progress.enabled in your PHP configuration as a temporary mitigation.

We take the security of our infrastructure and of your environments very seriously. We will keep monitoring the situation and share any relevant update. For any question, please contact our support team at support@tsplus.net.

Best regards,

Thomas Montalcino
Chief Technology Officer, TSplus

References: CERTFR-2026-ALE-014 · CERT-EU Security Advisory 2026-018