Skip to content
English
BrioHR Website
  • There are no suggestions because the search field is empty.

brioHR Security FAQ: PHP2Shell

In October 2026, two security vulnerabilities in PHP were publicly disclosed: CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. This article answers common questions about how brioHR uses PHP, the security updates we've applied (as of 21st October 2026), and the results of our log review.

Audience & Scope

Audience: IT/Security/Complience team/managers

Module: Core HR

Country: Global

 

1. Is brioHR's service portal built on a PHP-based CMS?

No. brioHR's main web application is hosted on AWS and runs on a NestJS backend. PHP is used separately, only for the recruitment job board.

2. Is PHP used anywhere in production?

Yes. The recruitment job board (boards.briohr.com) uses PHP-FPM to process job board pages and job application submissions.

3. What PHP version is currently running?

The production job boards in Singapore and Malaysia run PHP 8.2.35.

4. Have the fixes for CVE-2026-109618 and CVE-2026-109619 been applied?

Yes. PHP 8.2.35 includes both fixes. It was deployed to the production job boards in both regions on 21 October 2026 at 22:54 MYT.

As a precaution, job application submissions were temporarily paused before remediation and restored once the patched version was live.

5. Have logs been reviewed for suspicious activity since 20 October?

Yes. We reviewed AWS WAF logs and more than 1.6 million application log records for boards.briohr.com, covering 20 October to 22 October 2026 (13:15 MYT), with a focus on suspicious multipart/form-data requests.

No identifiable PHP2Shell exploit attempt or execution evidence was found. The review also found no logged PHP memory exhaustion, segmentation faults, worker crashes or shell-execution markers.

6. Can brioHR provide evidence of the running version?

Yes. The screenshot below shows PHP 8.2.35 reported by php -v inside a production job-board container. Separate direct checks confirmed PHP 8.2.35 for both PHP and PHP-FPM in Singapore and Malaysia.

 

Need Assistance?

If you have any questions or require assistance, please reach out to our support team via live chat or email us at support@briohr.com.

 

Ownership

By: Aqilah