Accops has confirmed that Accops HySecure Gateway is affected by two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. These vulnerabilities could allow remote code execution under the applicable exploitation conditions.
A patch release is now available. We strongly recommend that customers apply the relevant security patch at the earliest opportunity to protect their HySecure deployments.
Vulnerability Overview
| Detail | Information |
| Vulnerability | PHP2Shell |
| CVE identifiers | CVE-2026-109618 and CVE-2026-109619 |
| Severity | Critical |
| Affected product | Accops HySecure Gateway |
| Affected versions | All versions from 5.x through 7.x |
| Potential impact | Remote code execution under applicable exploitation conditions |
| Security advisory | ASA-2026-1001 |
| Remediation | Apply the relevant Accops security patch |
What Is the Potential Impact?
PHP2Shell refers to two critical vulnerabilities in PHP, a component used by Accops HySecure Gateway. If the applicable exploitation conditions are met, an attacker could potentially execute code remotely on an affected system.
Given the critical severity and potential impact, customers should prioritise remediation across affected HySecure Gateway deployments.
Security Patch Now Available
Accops has made a patched release available that updates PHP to the fixed version, addressing these vulnerabilities.
Customers running HySecure Gateway versions 5.x through 7.x should review Security Advisory ASA-2026-1001 and apply the relevant patch according to the deployment guidance provided.
Recommended Actions for Customers
- Identify affected deployments: Review your HySecure Gateway inventory for installations running versions 5.x through 7.x.
- Review the security advisory: Refer to the official advisory for the applicable patch and deployment instructions.
- Prioritise patch deployment: Apply the relevant security patch at the earliest opportunity.
- Validate the update: Confirm successful patch installation and verify normal operation after deployment.
- Contact Accops Support if needed: Request assistance with patch selection, deployment, or validation.
Official Security Advisory
For patch information and remediation guidance, refer to:
ASA-2026-1001 | PHP2Shell – Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)
Need Assistance?
For assistance with the security patch or its deployment, contact support@accops.com and include PHP2Shell in the subject line.
Please treat this update as a priority and apply the relevant patch promptly.
