Security
Security: FlowMan is not affected by the PHP "php2shell" vulnerabilities
Last updated: 22 October 2026
The critical flaws CVE-2026-109618 and CVE-2026-109619 affect websites running PHP. FlowMan does not use PHP: no action is required.
In short
FlowMan is not affected by CVE-2026-109618 and CVE-2026-109619. No action is required on your side.
What is it about?
Two critical PHP flaws (severity 9.2), disclosed on October 21, 2026, allow remote code execution on PHP web servers. The official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why FlowMan is not affected
The platform contains no PHP component. Its application and public website run on other technologies, and no PHP site or tool is attached to the flowman.net domain.
Our security practices
- Encrypted connections (HTTPS)
- Strong authentication, with two-factor authentication (2FA) available
- Data isolation per organisation
- Monitoring of security advisories and prompt patching
Any question?
Our team answers you through the Contact page.