Eptura has removed any publicly facing PHP impacted resources and applied patches where patches are available. We leverage CSPM and continuous external penetration testing to monitor our attack surface and are following the PHP security advisory closely. We do not have any internet reachable exposures at this time.
We continue to work with third-party vendors and monitoring their updates for available patches. Where patches are available they have already been applied. As stated above, we have no internet reachable exposure related to this issue and are monitoring that posture in an ongoing manner.
Posted Oct 23, 2026 - 18:45 UTC
Update
Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.
Posted Oct 22, 2026 - 10:26 UTC
Monitoring
Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.
Posted Oct 21, 2026 - 20:55 UTC
Update
Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.
Posted Oct 21, 2026 - 20:50 UTC
Investigating
We are actively monitoring the recently disclosed PHP vulnerabilities (details here: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) and have completed an initial assessment using our Cloud Security Posture Management tooling to inventory our PHP installations, with a focus on identifying internet-reachable exposures.
The critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are scheduled to be addressed through an official PHP security update being released on October 21, 2026. Consistent with vendor and industry guidance, we plan to deploy official security updates to affected resources once they become available and are validated.
At this time, we have not identified any customer impact related to these vulnerabilities and continue to closely monitor the situation.
Posted Oct 21, 2026 - 16:39 UTC
This incident affects: Eptura Engage (APIs, Desk Screens, Device Hub, Exchange Sync, M365 Integration, Mobile App, Outlook Add-In, Room Screens, SCIM, Web Application), Eptura Visitor (Access Control, Admin Dashboard, APIs / Webhook, Check in / LogBook, Emergency Lists, Integrations, Kiosk, Mobile App, Notifications, Printer / Printing, User provisioning, SAML Sign On), and Eptura Home, Eptura Asset, Eptura Workplace, Archibus by Eptura, SpaceIQ, Teem.