Hardcat takes the security of its website and the protection of its customers seriously. Following recent reports of critical PHP vulnerabilities known as PHP2Shell, we have assessed the potential impact on Hardcat’s environment and can provide reassurance about the steps taken to address the issue.
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to two identified PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have prompted security assessments across organisations using PHP-based websites and applications.
As part of Hardcat’s response, our Development Team assessed the potential impact on our internal environment and externally hosted website.
Is Hardcat affected by PHP2Shell?
Hardcat does not use PHP within its internal network or software environment. Our public website, Hardcat.com, does use PHP, but it is hosted separately from and isolated from our internal network and systems.
At the time of our assessment, Hardcat had not identified any indicators of compromise or evidence that these vulnerabilities had been exploited on our website.
Our hosting provider has subsequently confirmed that websites hosted on its platform, including Hardcat’s Production and Staging environments, are protected against CVE-2026-109618 and CVE-2026-109619. Hosting provider has advised that no customer-side action is required for these specific vulnerabilities.
What does this mean for Hardcat customers?
Hardcat’s internal software environment is not affected by these PHP vulnerabilities. While our public website uses PHP, it is separately hosted and isolated from our internal network and systems.
The website primarily provides public marketing and informational content. It is not used to process financial transactions or transact client data.
Based on our assessment and Hosting Providers confirmation, there is no identified reason for customers to take action in response to these two specific vulnerabilities.
How is Hardcat managing website security?
Security remains an ongoing responsibility. Hardcat will continue to monitor its website environment for signs of suspicious activity and maintain its website in accordance with its security management processes.
We also work with our hosting provider and website support team to address security advisories and apply relevant updates or mitigations as required.
Our commitment to customers
Hardcat is committed to providing reliable asset management and evidence management solutions while maintaining appropriate security practices across its own environment.
The PHP2Shell vulnerabilities have been assessed, and our hosting provider has confirmed protection against the two specific vulnerabilities identified. We will continue to monitor the environment and follow our established security management processes.
For further technical detail, please refer to the Hardcat PHP Vulnerability Assessment, prepared by the Hardcat Support Team on 23 October 2026.
