DCR Solutions is aware of CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. We only use PHP on our main website dcrsolutions.net and our documentation site documentation.dcr.design. In particular, the DCR Portal where DCR graphs are modelled does not use PHP and is not affected.

Incident response findings

Since we are using PHP on the named sites, we conducted incident response today, finding that:

• The DCR Documentation site, documentation.dcr.design, was running a vulnerable version. The to the non-vulnerable version 8.2.35 prior to 22 October 2026.
• The DCR website, dcrsolutions.net, was running the vulnerable version. The site was updated to the non-vulnerable version 8.2.35 on 22 October 2026.

• Neither of the sites using PHP shows any sign of present or historical exploitation.

Incident closed

DCR Security has closed the incident and estimates the residual risk to our customers as very low.

For further information or questions about this advisory, please contact us at info@dcrsolutions.net.