EN / FI

News · 26 October 2026

The PHP vulnerabilities do not affect Bitwards

CISA has urged organisations to patch two critical PHP vulnerabilities immediately. No part of the Bitwards platform, and no part of this website, runs PHP. Nothing in our service needs patching, and every customer and partner can safely keep using the service as usual.

What was announced

On 21 October 2026 CISA published an alert on two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, known together as “php2shell”. They allow unauthenticated remote code execution, and they affect every PHP installation that serves web requests — Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed alike. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

It is a serious one. PHP runs a large share of the web, often as a component of something else, which is why CISA’s first instruction is to find out where you have it at all.

Why Bitwards is not affected

We do not use PHP anywhere.

  • The cloud service that issues credentials and holds the access rights does not run PHP.
  • The mobile applications are native iOS and Android, and the library inside a lock is embedded firmware. Neither has any relationship to a web scripting language.
  • This website is static HTML, generated ahead of time and served as files. There is no application server behind it and no server-side code to execute.

There is nothing for us to patch in response to this advisory, and no action is needed from customers or partners on account of it. Every customer and partner can carry on using the service exactly as before. Doors keep opening, credentials keep being issued, and the integrations keep running — this advisory changes nothing about any of it.

What this does not mean

It does not mean a customer has nothing to do. PHP is widely embedded in other products, and a building running Bitwards may well run PHP elsewhere — in a booking system, an intranet, a property management tool, a website. CISA’s advice stands for all of those: inventory, patch, and take anything unpatchable offline until it can be fixed.

If you integrate with Bitwards through our REST APIs from a PHP application, the vulnerability is in your PHP installation rather than in the integration — but it is still yours to patch.

CISA alert →

Bitwards Oy, 26 October 2026. Security questions: info@bitwards.fi.

← All news and blog