Customer notice | 22 October 2026
We have reviewed the Medanets application components and found no use of PHP. The PHP vulnerabilities disclosed on 21 October 2026 therefore have no direct impact on Medanets services. Customer-specific server environments must be checked separately.
Ensure the security of your server environments
Medanets does not use PHP in its services. However, other software using PHP may run on the same server or in the same container. Vulnerabilities in such software may affect the security of the server environment even when the Medanets application itself does not use PHP.
If a PHP or PHP-FPM process is detected on a Medanets server, please report it to our customer support team at help@medanets.com. The origin and version of the component, and its relationship to the Medanets deployment, must be established before drawing conclusions about the specific environment. Any vulnerable component must be updated in accordance with the vendor’s instructions in cooperation with the environment’s administrator.
About the vulnerabilities
The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 may allow an attacker to execute code on a server without authentication. They affect PHP installations that handle web requests, including PHP-FPM. The vendor released security updates on 21 October 2026.
Further information: National Cyber Security Centre Finland advisory 37/2026 and PHP security advisory of 21 October 2026