Monitoring
Dear customers,
On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities in the PHP runtime, together referred to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both allow unauthenticated remote code execution and are already being exploited in the wild. As soon as the patches were published, we assessed our assets against the affected versions.
IDnow products and services are not affected. No product or service we provide to you runs a vulnerable PHP build, and our public website has been reviewed and is fully patched. No action is required from you currently.
If your security team would like the technical basis for this assessment, our ServiceDesk team can arrange a call with the IDnow Security team. In case you have any questions or need further assistance, please contact IDnow Support: https://support.idnow.io
Posted Oct 23, 2026 - 15:17 CEST
This incident affects: Ident Centers (Ident Center Munich, Ident Center Iasi, Ident Center Split, Ident Center Athens, Ident Center Zagreb, Ident Center Osijek, Ident Center Metkovici, Ident Center Brasov, Ident Center Simeria, Ident Center Sarajevo, Ident Center Pune), IDnow Solutions (VideoIdent, eID, AutoIdent, AutoIdent QES, POS, Check'nSign.io, IDCheck.io, ETSI, IDCheck.io PVID, YRIS, eSign, InstantSign, eSign Wallet, Subscribe to SDK notifications, SmartStamp, Document-based IDV, Trust Platform), and Test Systems (VideoIdent, eID, AutoIdent, AutoIdent QES, POS, Check'nSign.io, IDCheck.io, ETSI, IDCheck.io PVID, YRIS, eSign, InstantSign, eSign Wallet, SmartStamp, Document-based IDV).