October 27, 2026
Our response to the PHP2Shell vulnerabilities
To our clients and partners,
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, now widely known as PHP2Shell. These flaws could allow an attacker to run code on an unpatched server, or read data from its memory, without logging in. National cybersecurity agencies worldwide, including the Cyber Security Agency of Singapore (Advisory AL-2026-151), urged organisations to patch immediately.
Here’s what this meant for Avvanz and how we responded.
We have completed patching our platform. Avvanz ScreenGlobal 3.0 runs on PHP, so we treated this as a priority incident from the moment the fixes were published. Our teams assessed every production system that day, began patching on 22 October, and completed and verified the upgrade to the secure, patched PHP version across all production hosts by the morning of 23 October. There was no service downtime.
We have found no evidence that our systems or your data were compromised. Because exploitation attempts against these flaws were seen across the internet before the fixes were released, we did not limit our review to the patch window. We examined intrusion detection logs, web application firewall data and network telemetry. We found no evidence of successful exploitation and no evidence of unauthorised access to client data, candidate screening files or personal information.
You do not need to take any action. All fixes were applied at the platform level. Your integrations, endpoints and administrator credentials are unchanged, and all background screening services are operating normally.
Background screening means handling some of the most sensitive information people share with an employer. Our clients trust us with that information, and we take that trust personally. Our security team continues to monitor the platform closely, and we are tracking further PHP advisories as they emerge.
If your security, risk or compliance team would like more detail for your vendor records, please contact us at security@avvanz.com. We are happy to walk you through our response.
From:
Kannan Chettiar, CEO of Avvanz
Andre Siregar, CTO of Avvanz