On October 20th, 2026 a pair of critical vulnerabilities affecting the PHP scripting language, publicly referred to as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), were announced. At Square 9, we take all security threats very seriously and review our source code, toolkits, and references when such events occur.
We are happy to report that the PHP2Shell threat does not in any way impact Square 9 products, and no Square 9 code is susceptible to this vulnerability. The threat specifically targets the PHP language interpreter, and as .NET based applications, GlobalSearch, GlobalCapture, GlobalForms, and the broader Square 9 platform remain unexposed. PHP is not a component of, bundled with, or a runtime dependency of any Square 9 product, and installing Square 9 software does not introduce PHP into your environment.
Square 9 Cloud customers are not impacted by this vulnerability.
Because PHP is widely deployed, customers are encouraged to speak with all of their technology vendors and, where PHP is used elsewhere in their environment, apply the fixed PHP release as soon as possible. This is a standard precaution and is not required for any Square 9 product.