Following the news of the PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Milestone has assessed its products and technology for potential exposure.  

The security assessment found that Milestone's XProtect, Arcules, BriefCam, Husky Project Hafnia, and brighter AI are not affected by the PHP2Shell vulnerabilities.  

No action is required for users of XProtect, Arcules, BriefCam, Project Hafnia, and brighter AI in relation to the PHP2Shell vulnerabilities, and they can continue using these products. 

The Milestone Evidence Manager, an extension to XProtect, currently uses a vulnerable version of PHP. Milestone advises all users of Evidence Manager to upgrade their installation to PHP to version 8.2.35 using the following steps:

sudo apt update && apt-cache policy php8.2-fpm

# The output of this needs to show an option for 8.2.35. Keep running that until it does. The fetch of this new package info can fail.

sudo apt upgrade

# This can also fail to download the needed package. keep running until it completes successfully

Milestone will continue to monitor the situation closely and will provide updates should new relevant information become available.