Eptura Advisory: PHP Vulnerability Disclosure Archibus, Eptura Asset, Eptura Engage, Eptura Visitor, Eptura Workplace, SpaceIQ, Teem

Update timeline

1. investigating Oct 21, 2026, 04:39 PM UTC

   We are actively monitoring the recently disclosed PHP vulnerabilities (details here: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) and have completed an initial assessment using our Cloud Security Posture Management tooling to inventory our PHP installations, with a focus on identifying internet-reachable exposures. The critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are scheduled to be addressed through an official PHP security update being released on October 21, 2026. Consistent with vendor and industry guidance, we plan to deploy official security updates to affected resources once they become available and are validated. At this time, we have not identified any customer impact related to these vulnerabilities and continue to closely monitor the situation.

2. investigating Oct 21, 2026, 08:50 PM UTC

   Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.

3. monitoring Oct 21, 2026, 08:55 PM UTC

   A fix has been implemented and we are monitoring the results.

4. monitoring Oct 22, 2026, 10:26 AM UTC

   Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.

5. monitoring Oct 23, 2026, 06:45 PM UTC

   Eptura has removed any publicly facing PHP impacted resources and applied patches where patches are available. We leverage CSPM and continuous external penetration testing to monitor our attack surface and are following the PHP security advisory closely. We do not have any internet reachable exposures at this time. We continue to work with third-party vendors and monitoring their updates for available patches. Where patches are available they have already been applied. As stated above, we have no internet reachable exposure related to this issue and are monitoring that posture in an ongoing manner.

6. resolved Oct 27, 2026, 08:19 PM UTC

   Eptura has taken the necessary steps to address this vulnerability issue, and we have confirmed there is no internet-reachable exposure at this time. We will continue to monitor the situation and apply any additional updates as needed. If you have any questions or concerns, please reach out to our Support team through the Customer Hub at https://customer.eptura.com/s/