PHP security vulnerabilities (October 2026)

On 21 October 2026, two critical security vulnerabilities in the PHP programming language were published (CVE-2026-109618 and CVE-2026-109619, also known as "php2shell"). There is no risk for e-guma. Read below what to check on your own website.

In this article

Is e-guma affected?

No. The vulnerabilities only affect servers running PHP. The e-guma applications you work with do not use PHP:

  • e-guma Back Office
  • Online shop for vouchers, tickets and products
  • Ticket App and Voucher App
  • voucher2mobile
  • Interfaces (API)

You do not need to take any action in e-guma.

Our company website e-guma.ch uses PHP. We have already installed the security update there. The website is separate from the e-guma applications and does not contain any data from your e-guma Back Office.

Your own website

Many websites run on a content management system such as WordPress, Joomla, TYPO3 or Drupal. These systems are based on PHP and may be affected as long as the security update is not installed.

Your e-guma online shop runs on e-guma's servers, even if you link to it from your website. A vulnerability on your website therefore does not affect the online shop or your data in the e-guma Back Office.

Have your website checked anyway. If it is attacked, attackers could, for example, redirect the link to your online shop to a fake page.

What you should do now

  1. Ask your web agency or hosting provider whether your website uses PHP and whether the security update has already been installed.
  2. Click the links to your online shop on your website and check that your usual shop address appears in the browser.

Further information on the vulnerabilities is available from the responsible authorities: