On 20 October 2026, the PHP security team announced an urgent security release for two critical remote code execution vulnerabilities in PHP. They are tracked as CVE-2026-109618 and CVE-2026-109619 and are nicknamed “PHP2Shell”. Both are rated 9.2 (CVSS v4.0) and affect web servers running PHP 5.4 or later. Details leaked before the coordinated release, so security researchers expect attacks to follow quickly.
So is your Thinkwise environment at risk? It is not.
No impact on the Thinkwise Platform
The Thinkwise Platform does not use PHP. None of our components contain PHP code, and none of them need a PHP runtime on your servers. Your Thinkwise environment is not affected, and no action is needed for it.
The technologies behind the Thinkwise Platform
For those interested, here is a short overview of what the platform is built on:
- Database: Your application’s data and business logic live in the database. The platform supports Microsoft SQL Server, Oracle, IBM Db2 and PostgreSQL.
- Indicium: Our application tier and API, built on Microsoft .NET. Indicium handles authentication, authorization, the OData API and process flows. It runs on IIS or nginx.
- Universal UI: Our current user interface, built with React and Javascript.
- Windows GUI: Our older desktop user interface, built on Microsoft .NET.