Security Fix Available for Critical PHP Vulnerabilities in WYS Platform 2026 R2
21.10.2026, Notice updated on 22 October 2026
PHP Group announced on 21 October 2026 two critical vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619).
The WYS Platform utilizes PHP software as part of its technology stack, and the security fixes for these vulnerabilities are now included in the WYS Platform 2026 R2 package.
We strongly recommend updating WYS Platform to version 2026 R2 as soon as possible. If the update cannot be installed immediately, we recommend isolating the system from the Internet until the update has been applied.
Additional information about the vulnerabilities is available in the advisory published by Traficom’s National Cyber Security Center (in Finnish): https://kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37
If you have any questions or need assistance with the update installation, please do not hesitate to contact us directly via email helpdesk[at]wys.fi.