If you’ve read about the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and wondered whether BackupAssist is affected, the answer is no. Your BackupAssist software is not affected, and you don’t need to update or change anything.
Which BackupAssist products are affected
None of the following BackupAssist products or services were affected.
- BackupAssist Classic
- BackupAssist ER
- BackupAssist 365
- MultiSite Manager
- The Managed Backup Console
Your backups need no update or change because of PHP2Shell.
Where the flaw is
The flaw is in PHP itself, not in our own code, so we didn’t need to change any of our code.
Some of the servers that run our websites and online portals use PHP. Those were the servers affected. None of them is software that you install or run yourself.
What we did about our own servers
Our web team upgraded PHP on every affected server that can be reached from the internet. They finished by 8pm AEDT on Thursday, October 22, 2026 (09:00 UTC). The versions they upgraded to contain the official fix for both vulnerabilities.
For security reasons, we do not disclose specific PHP versions or detailed server configurations.
How we checked for signs of attack
Over the weekend of October 24 and 25, the web team checked every upgraded server. They looked for:
- Any file created or changed since October 15, which is before the first known attack attempt
- Unknown programs running
- Unexpected connections out of the server
- Changes to user accounts or access keys
They found none of these. We found no evidence that any customer or partner data was accessed.
Did anyone try to use the flaw against us?
Like many websites, our servers received automated scans looking for the flaw. Our servers refused those requests, and our forensic checks found no evidence that any attempt was successful.
What you need to do
Nothing.
If you have any questions, contact our support team at support@backupassist.com.
Resellers and distributors, you’re welcome to share this post with your own customers. If they ask anything it doesn’t cover, send their questions to us and we’ll answer them.
