Security statement: PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Last updated: October 27, 2026

Flexmonster Software is not affected by PHP2Shell, so you do not need to update it in response to these vulnerabilities. The Flexmonster website, which uses PHP, has been updated to a release that fixes the PHP2Shell vulnerabilities.

Flexmonster Software. Current versions of Flexmonster Pivot Table & Charts, including the optional server-side component, Flexmonster Data Server, do not contain or require PHP. The software runs entirely within your own infrastructure. Flexmonster does not host it or have access to the data it processes, so data in your applications stays under your control.

Systems operated by Flexmonster. The Client's Area, which manages account and license information, and our customer relationship platform do not use PHP. The Flexmonster website runs on PHP. We updated it to PHP 8.3.36 on October 21, 2026, the day the fix was released, and applied the mitigation for the follow-up issue, CVE-2026-115560. The website is protected by a web application firewall and stores limited customer account information, as described in our Privacy Policy.

Evidence of exploitation. We reviewed our website logs for the period from August 24 to October 26, 2026, and found no evidence of successful exploitation or compromise. We will update this statement if our findings change.

Action required. None for Flexmonster Software. If you run PHP in your own environment, including for the deprecated PHP version of Flexmonster Data Compressor, we recommend updating to the latest security release for a supported PHP version and following the PHP team's guidance on CVE-2026-115560.

This statement reflects our assessment as of the date above, is provided for informational purposes only, and does not amend any agreement between you and Flexmonster.

If you have questions about this statement, please contact us through our contact form.