Critical PHP Security Vulnerability: Abacus ERP is not affected

The recently disclosed security vulnerability “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) is currently attracting significant attention across the global IT industry. According to Germany’s Federal Office for Information Security (BSI), these are two critical vulnerabilities affecting the widely used PHP programming language, potentially allowing the execution of malicious code on affected web servers.

The BSI recommends that operators of PHP-based web applications install the published security updates immediately and closely monitor their systems. Based on current information, all known PHP versions may be affected.

No impact on Abacus customers

The announcement of these critical PHP vulnerabilities has attracted considerable attention worldwide. However, Abacus users can rest assured: Abacus ERP does not use PHP technology and is therefore not affected by the reported vulnerabilities. This has been confirmed by Abacus Research AG.

As an Abacus Platin Partner, Fidigit continuously monitors security-related developments and transparently informs customers about any potential impact on their systems.

The vulnerabilities therefore do not affect the core of the Abacus software.

Precautionary measures

To ensure the highest security standards, selected supporting services and cloud systems have been temporarily deactivated as a precautionary measure. This includes the BuildInfo API, which may currently affect certain functions such as the ERP Update Check and SilentHotfixes within the Service Manager. If required, SilentHotfixes can still be installed manually.

These measures are purely preventive and demonstrate the importance that both Abacus and Fidigit place on protecting customer systems.