Official Security Advisory – PHP2Shell Vulnerabilities

Date: 23 October 2026, 2:47PM
Issued by: Epoint Systems Pte Ltd

Epoint Systems is aware of the recently disclosed PHP security vulnerabilities, collectively referred to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), as highlighted by Wiz and other cybersecurity researchers.

Upon becoming aware of these vulnerabilities, Epoint Systems promptly initiated precautionary and remediation measures to safeguard our software solutions and minimise potential security risks.

1. Immediate Security Mitigation – Cloudflare WAF Protection

As an immediate precautionary measure, Epoint Systems has implemented the relevant Cloudflare Web Application Firewall (WAF) security protections to mitigate potential exploitation attempts associated with the identified PHP2Shell vulnerabilities.

These protections provide an additional layer of security while the necessary PHP security updates are being applied.

The relevant WAF rules have been configured to provide active protection against identified exploitation patterns.

2. QR Code Ordering Software – Security Updates Completed

Epoint Systems has successfully completed the necessary security updates for our QR Code Ordering Software.

The PHP runtime environment has been upgraded to PHP version 8.2.35, which incorporates the official security fixes addressing CVE-2026-109618 and CVE-2026-109619.

3. Cirrus Cloud BackOffice – Security Updates Completed (23/10/26)

Epoint Systems is currently implementing the necessary PHP security updates for our Cirrus Cloud BackOffice platform.

~~The patching process is underway and is scheduled to be completed by 6:00 PM (Singapore Time) on 23 October 2026, subject to successful deployment and verification.~~

UPDATE: The patching process has been completed on 5:18PM, 23 October 2026.

Cloudflare WAF security protections have also been implemented as an additional mitigation measure during this update process.

4. In.Contact CRM – Security Updates in Progress (28/10/26)

Epoint Systems is currently implementing the necessary PHP security updates for our In.Contact CRM platform.

The patching process is scheduled to be completed by 6:00 PM (Singapore Time) on 28 October 2026, subject to successful deployment and verification.

Cloudflare WAF security protections have also been implemented as an additional mitigation measure during this update process.

5. Ongoing Security Monitoring and Commitment

Epoint Systems remains committed to maintaining the security, stability, and integrity of our software solutions.

We will continue to monitor relevant cybersecurity advisories, review our security measures, and implement necessary updates to address emerging vulnerabilities.

We recognise the importance of maintaining a secure and reliable operating environment and will continue taking appropriate preventive measures to safeguard our platforms and customers.