Introduction
Safe Software is aware of the vulnerabilities known as CVE-2026-109618 and CVE-2026-109619 (collectively referred to as “php2shell”) impacting PHP.
This article provides an overview of our analysis of these vulnerabilities and our mitigation advice for users. We will continuously update this article as we have new information to share.
Summary Table
| Application | Version(s) Affected | Platform | Remediation | Workaround |
|---|---|---|---|---|
| FME Engine | Not affected | |||
| FME Form | Not affected | |||
| FME Flow | Not affected | |||
| FME Flow Hosted | Not affected | |||
| FME Realize | Not affected | |||
| FME License Server | Not affected | |||
According to our assessment, FME is not affected by the PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 as shipped. FME products do not bundle, require, or run on PHP.
FME Platform Applications
FME Form
All versions of FME Form are not affected by the vulnerabilities described as CVE-2026-109618 and CVE-2026-109619.
FME Flow
All versions of FME Flow are not affected by the vulnerabilities described as CVE-2026-109618 and CVE-2026-109619.
FME Flow Hosted
All versions of FME Flow Hosted are not affected by the vulnerabilities described as CVE-2026-109618 and CVE-2026-109619.
FME Realize or Deprecated FME Mobile Applications
All versions of FME Realize are not affected by the vulnerabilities described as CVE-2026-109618 and CVE-2026-109619.
FME License Server
All versions of FME License Server are not affected by the vulnerabilities described as CVE-2026-109618 and CVE-2026-109619.
FAQ
What should I do if PHP is installed elsewhere in my environment?
No action is required for FME products. However, PHP may be installed on other servers in your environment, for example, on hosts running other, non-Safe software applications that integrate with FME Flow. The PHP Foundation released fixed versions on October 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Upgrading is the recommended remediation. Please refer to the PHP Foundation’s security advisory for details.
How can I be notified of FME Platform security updates in the future?
If you would like to be notified of FME Platform security updates from Safe Software, we encourage you to subscribe to our Security Updates email list by signing up via the form on our Security page. Please note that mass notifications are sent to the Security Updates mailing list exclusively when there is a direct security impact on users that requires actionable measures (such as applying a product security update).
Reporting Security Issues
If you believe you have discovered a vulnerability in the FME Platform, our website, or our other products, please email us as quickly as possible at security at safe dot com.
We greatly appreciate the efforts of security researchers and discoverers who share information on security issues with us, giving us a chance to improve our products and better protect our users. Please note that we do not compensate individuals or organizations for identifying potential or confirmed security vulnerabilities.
Support
If you have questions or concerns regarding this advisory, please raise a support request. You can view all of our security notices on our Security Center.