Security advisory: php2shell (CVE-2026-109618, CVE-2026-109619)

A critical vulnerability in PHP, the language part of InvoiceCast is built on, was disclosed on October 21, 2026. We applied the security update across all InvoiceCast services the same day, as soon as the patched version was available. We reviewed our logs for the period before the update and found no evidence that the vulnerability was used against InvoiceCast or that any customer data was accessed.

You don't need to do anything. If you have questions, contact support.