PHP-Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

In October 2026, several critical vulnerabilities affecting core PHP (CVE-2026-109618 and CVE-2026-109619), a widely used scripting language that powers a significant share of websites worldwide, were publicly disclosed. If successfully exploited, these vulnerabilities could potentially allow unauthorized access to affected servers, compromise sensitive information, or impact website integrity.

Following the disclosure, MetaSystems promptly reviewed its web infrastructure and implemented appropriate security measures to mitigate the identified risks. Based on our assessments and the information currently available to us, we have no indication that any MetaSystems websites were affected by these vulnerabilities or that visitors to our websites experienced any security-related impact as a result.

Following the disclosure of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, Wibu (the manufacturer of our CodeMeter license protection system) provided information regarding their potential impact on CodeMeter License Central and related components, including WebDepot, Gateways, the Customer License Portal, and various connectors.

MetaSystems neither operates a CodeMeter License Central instance nor uses a Wibu-hosted deployment. Instead, license dongles are programmed directly from internal software via the MSCodeMeter.dll, without the involvement of PHP-based components. Furthermore, CodeMeter Runtime and its WebAdmin component are not affected by the reported vulnerabilities.

Accordingly, we have determined that these vulnerabilities are not relevant to MetaSystems products or services, and no further measures are currently planned. This assessment is based on the information available at the time of review.