Industry-wide PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619) - none of the Verified products are affected.

Thursday, 22 October 09:57 CEST
Industry-wide vulnerability Security

We are aware of the industry-wide PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619) and have assessed our environments.

None of our products are affected. The AML Portal, Screening API, Verified eSign, Assently eSign, eID Identification, and GRC Due-Diligence application codebases and infrastructure are not impacted by PHP2Shell.

Our review found two minor resources that use PHP-based technology: the GRC Watch business website (grcwatch.com) and an integration with Sympa HR. Both have been secured against PHP2Shell.

No action is required from customers. If you have questions, please contact our Support team.

Avatar for Verified Support
Verified Support
Affected components
  • Verified AML
    • AML Portal 1.5
      • AML 1.5 Portal GUI
      • Company Lookup
      • ID-control
      • PDF generation
      • Screening
      • Forms
    • AML NextGen
      • AML NextGen Portal GUI
      • API
      • Forms
      • Data sources
      • PDF generation
      • Screening API
    • Verified AML Screening API
  • Verified eSign and Document Management
    • Verified eSign
      • API
        • Authentication
        • Envelope actions
        • Query
      • Flows
        • Default flow
        • PDF generation
      • Integrations
        • Brønnøysundregistrene
        • Bisnode Services
        • BankID AML
        • NETS ID-Rights Services
        • KAR Register Services
      • Notifications
        • E-mail notifications
        • SMS notifications
      • Signing
        • BankID Norway
        • BankID Sweden
        • BankID Finland (FTN)
        • MitID Denmark
        • eID Easy (Estonia, Latvia, Lithuania)
        • SMS
        • Email
        • Touch
      • Archive
      • Verified Secure Authentication
        • BankID Norway
        • BankID Sweden
        • BankID Finland (FTN)
        • MitID Denmark
        • Belgian eID
        • Estonian eID
        • Latvian eID
        • Lithuanian eID
        • Portuguese ID
        • Serbian ID
        • Freja eID (International)
        • SMS authentication
      • Web portal
        • Login
        • Envelope Builder
        • Access Management: Users & Companies
        • Checkout
        • Recipient portal
    • Assently
      • Assently e-Sign
      • Assently CoreID
      • Electronic ID Providers
        • Swedish BankID
        • Freja eID+
        • Finnish Bank Identification
        • Finnish Mobiilivarmenne
        • Finnish VRK
        • Norwegian BankID
        • Danish MitID
      • Notifications
        • Email Notifications
        • SMS Notifications
      • E-Sign Test Environment
    • Procountor Signatur
      • Login service
      • Envelope builder
      • Notifications
        • Email
        • SMS invitation
      • Signing
        • BankID Sweden
    • Procountor Allekirjoitus
      • Login service
      • Envelope builder
      • Notifications
        • Email
        • SMS invitation
      • Signing
        • BankID Finland (FTN)
    • Verified Contract Management
  • GRC Watch