FYI: Reportworq is not affected by the October 2026 PHP vulnerabilities
Quote from Matt Hopkins on October 23, 2026, 3:37 pmWe’ve had several questions about the recently disclosed PHP vulnerabilities, including the “PHP2Shell” flaws. Here is where Reportworq stands:
- Reportworq does not use PHP. The product is built on Microsoft .NET. No component of any Reportworq version installs, bundles or depends on PHP. That covers the server, the web interface, the installers, the Docker image and the Office add-in.
- Reportworq is not affected. These vulnerabilities are in the PHP interpreter itself, so they only affect systems that run PHP.
- You don’t need to do anything in Reportworq. No patch is needed and none is planned, because the product is not affected.
One general note: if a server that hosts Reportworq also runs other PHP applications, patch those to a fixed PHP release (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later) under your normal process. That work is separate from Reportworq.
This information is related to the following PHP CVEs
Regarding the following PHP CVE's
CVE-2026-109618
CVE-2026-109619
CVE-2026-115560
We’ve had several questions about the recently disclosed PHP vulnerabilities, including the “PHP2Shell” flaws. Here is where Reportworq stands:
- Reportworq does not use PHP. The product is built on Microsoft .NET. No component of any Reportworq version installs, bundles or depends on PHP. That covers the server, the web interface, the installers, the Docker image and the Office add-in.
- Reportworq is not affected. These vulnerabilities are in the PHP interpreter itself, so they only affect systems that run PHP.
- You don’t need to do anything in Reportworq. No patch is needed and none is planned, because the product is not affected.
One general note: if a server that hosts Reportworq also runs other PHP applications, patch those to a fixed PHP release (8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later) under your normal process. That work is separate from Reportworq.
This information is related to the following PHP CVEs
Regarding the following PHP CVE's
CVE-2026-109618
CVE-2026-109619
CVE-2026-115560