Dear Customer,

Tybera is actively responding to two critical, industry-wide PHP vulnerabilities, CVE-2026109618 and CVE-2026-109619, collectively referred to as PHP2Shell. These vulnerabilities could allow unauthenticated attackers to remotely execute code on some of Tybera’s internal websites. None of Tybera’s software including eFlex e-filing, Alpine CMS, and CEDAR document storage uses PHP so there is no vulnerability associated to those software products.  In addition, Tybera does not use PHP on our hosted application servers although the Tybera.com does use PHP.

These vulnerabilities could potentially affect the Tybera.com website and internal tools such as, Tybera OS ticketing, and Tybera support. Tybera IT and Security teams immediately began the process of investigating and patching the affected servers. OS Ticket is already patched and expected to be online within the next 24 hours.  Because of this, Tybera has taken down access to these sites.  Because this vulnerability is limited to Tybera’s internal network and not associated to any Tybera software or hosted environments, we are sending this notice to our customers as a security advisory notice.  

Recommended Actions

The most important action is for customers to determine if they have applications that run on PHP and update the app with patches immediately. Tybera also recommends that organizations:

• Identify all instances of PHP. Look beyond known web servers. PHP may also be embedded in hosting control panels, third-party applications, network appliances, bundled software, and other vendor products.
• Prioritize internet-facing systems. Patch and verify externally accessible PHP systems first, followed by internal applications and other affected infrastructure.
• Monitor for signs of exploitation. Investigate unexpected shells, interpreters, child processes, or download utilities launched by PHP or web-server processes such as php-fpm and Apache.  
• Apply additional safeguards while patching is underway. Restrict unnecessary network connectivity, maintain appropriate web application firewall protections, and apply least privilege to accounts running PHP.

Sincerely,

Tybera  Development Group, Inc.