Security advisory on PHP2Shell vulnerabilities
On 21 October 2026, two critical security vulnerabilities were disclosed in PHP, collectively known as PHP2Shell. These vulnerabilities could allow unauthenticated attackers to execute arbitrary code on affected systems.
Elvaco AB, including its subsidiary cThings Limited, has reviewed the disclosed vulnerabilities and assessed their applicability to its products and services.
Impact assessment
No security breach has been identified at Elvaco or cThings, and there is no evidence of unauthorized access to, disclosure of, or alteration of customer data.
Elvaco AB products and services: not affected
Elvaco AB products and services are not affected by CVE-2026-109618 or CVE-2026-109619. The assessment covers:
- Hardware and firmware: Elvaco devices, communication modules and gateways.
- Software: Elvaco AB software applications and solutions.
- Cloud services: Elvaco Play and EVO, Webshop, Key Management Services.
cThings Cloud: affected and remediated
cThings Cloud, operated by cThings Limited (an Elvaco company), was affected by the vulnerability. cThings Limited applied the security fixes centrally to the managed platform on 21.10.2026, and the vulnerability has been fixed.
Customer action
No customer action is required.
Elvaco products need no firmware updates, software patches or configuration changes. The cThings Cloud updates have been applied centrally by cThings Limited. Customers should separately assess any third-party systems within their metering infrastructure that may use PHP, including external web portals and data platforms.
Ongoing security commitment
Elvaco continuously monitors security advisories, assesses their relevance to its products and services, and takes appropriate action when necessary. Should new information change our assessment, we will update this advisory and communicate any required actions.
References & contact
Official PHP security advisory · PHP release announcement (21 October 2026)
Elvaco Support · support@elvaco.com · support.elvaco.com
cThings Support · support@cthings.io · cthings.io