Puzzle Technology
← All incidents

Notice to Customers - PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Maintenance · resolved · started 23 Oct 2026, 13:02 · resolved 23 Oct 2026, 13:03

Fuse2 Communications

  1. resolved · 23 Oct 2026, 13:15

    The scheduled maintenance window ended at 23 Oct 2026, 13:03. Closed automatically by the status page.

  2. identified · 23 Oct 2026, 13:11

    Components: MyPhones/Evonex, Hosted 3CX, Inbound Call Termination, ORCA Window: 2026-10-23T12:02:00+00:00 → 2026-10-23T12:03:00+00:00 Fuse 2 is aware of the two critical PHP vulnerabilities known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). The PHP project released a security fix for them on 21 October. These flaws let an attacker run code remotely on affected PHP installations, and they are being actively exploited. We have reviewed all of our products, services and internal systems. Most of them, including our hosted telephony platform, and supporting overlay products, do not use PHP and are not affected. Where an internal system does use PHP, we have applied the security update. If you have any questions, please contact our Support Team.