Eptura Advisory: PHP Vulnerability Disclosure

Update timeline

1. investigating Oct 21, 2026, 04:35 PM UTC

   We are actively monitoring the recently disclosed PHP vulnerabilities (details here: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) and have completed an initial assessment using our Cloud Security Posture Management tooling to inventory our PHP installations, with a focus on identifying internet-reachable exposures. This advisory applies to Serraview, which utilizes PHP as part of its technology stack. The critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are scheduled to be addressed through an official PHP security update being released on October 21, 2026. Consistent with vendor and industry guidance, we plan to deploy the official security update to affected Serraview environments once it is available and validated. At this time, we have not identified any customer impact related to these vulnerabilities and continue to closely monitor the situation. Customer Action: Beginning October 21, 2026, customers should plan for a maintenance window to support deployment of the PHP security update to Serraview environments and any required validation activities.

2. investigating Oct 21, 2026, 08:16 PM UTC

   Eptura continues to actively respond to the critical PHP vulnerabilities impacting PHP and certain PAN-OS components. For Serraview, we have implemented available mitigations to reduce exposure, including removing any high-risk internet-facing resources from external accessibility where feasible. At this time, we have no indication of compromise. The applicable PAN-OS security patches are not yet available from Palo Alto Networks. Once those updates are released, Eptura will promptly evaluate and deploy them based on our assessment of risk, exposure, and operational impact. We will communicate any required maintenance window in advance. In the interim, we continue to monitor the environment, scan for potential exposure, and follow vendor and CISA guidance as it becomes available.

3. monitoring Oct 22, 2026, 10:33 AM UTC

   Eptura has now implemented the available mitigations for Serraview to address the identified PHP vulnerabilities and mitigate potential exposure. At this time, we have no indication of compromise or customer impact. Applicable security patches will be evaluated and applied as they become available. We continue to actively monitor the environment for any potential exposure and will take further action as necessary.

4. monitoring Oct 23, 2026, 06:43 PM UTC

   Serraview Eptura has removed any publicly facing PHP impacted resources and applied patches where patches are available. We leverage CSPM and continuous external penetration testing to monitor our attack surface and are following the PHP security advisory closely. We do not have any internet reachable exposures at this time. We continue to work with third-party vendors and monitoring their updates for available patches. Where patches are available they have already been applied. As stated above, we have no internet reachable exposure related to this issue and are monitoring that posture in an ongoing manner.