On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.
We can confirm that MicrOpay and Employee Self Service (ESS) are not affected by these vulnerabilities.
Both products remain unaffected, and no action is required from customers in relation to these vulnerabilities.
