Updated information about the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
What happened On 20 October 2026, the PHP Project announced two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which are also known as "PHP2Shell". Under certain conditions, these vulnerabilities could let an attacker run code on an affected server without logging in. The PHP Project released official security patches on 21 October 2026.
How it affected our services Some of our customer-facing services use PHP and were within the affected version range: · Varbi · ReachMee career sites · Realcruit · Ontame analytics · Jobtip · Websites: Valtiolle.fi, Kuntarekry.fi, Kirkkorekry.fi, Talentech.com
Other services Talentech offer do not use PHP and were not affected.
What we have done We applied the official PHP security patches following our urgent change procedure to all affected services directly after the updated PHP versions were made available. Services that were dependent on 3rd party manage PHP services with delayed availability were closed until the patch became available and web site updated. All of our services run the latest patched PHP versions from the morning of the 22nd. ATS's was updated within 3,5 h after the release.
In addition, we have reviewed logs and monitoring data for the relevant period and have found no proof that the vulnerabilities were exploited or that customer data was accessed. Since there were public indications that the vulnerabilities were known and started to be exploited several days before the official PHP Project publication, this was taken into consideration during the log reviews.
Also sub providers have been contacted and cleared from potentially affecting our services.
Do you need to do anything? You do not need to take any action for our services. If you run PHP on your own systems, we recommend that you follow the PHP Project’s advice and update to a patched version as soon as possible.
Questions If you have questions, please contact our customer support.