QScan Security Update: Recent PHP Vulnerabilities and Our Upcoming PHP Upgrade

23 October 2026

Following the recent disclosure of critical security vulnerabilities affecting PHP, we would like to provide an update on their potential implications for QScan, explain how QScan's typical deployment architecture influences security exposure, and share our plans for updating the PHP components used by the application.

We understand that these announcements may raise concerns, and we want to provide clear information about the situation and the steps we are taking.

Understanding the recently disclosed PHP vulnerabilities

On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Under certain circumstances, these vulnerabilities may allow unauthorized attackers to execute malicious code on servers running affected versions of PHP.

These vulnerabilities affect PHP itself, a technology widely used by websites, web applications, and software platforms worldwide. They are not specific to QScan. While these security issues must be taken seriously, it is important to distinguish between different deployment environments when evaluating the actual exposure of an application.

How does this affect QScan?

QScan is primarily designed and deployed as an on-premises web application, operating within a customer's own infrastructure rather than as a publicly accessible internet service.

This distinction is particularly relevant when assessing security exposure. Unlike public websites, which are continuously accessible from the internet and can receive requests from virtually anywhere, a typical QScan installation operates within a controlled corporate environment. In most deployments, access to the QScan web interface is restricted to an organization's internal network or provided through controlled remote-access mechanisms, such as a corporate VPN.

As a result, QScan installations that are not publicly accessible generally have significantly less exposure to attacks originating directly from the internet than publicly hosted websites or applications.

This reduced exposure is an important security consideration and should be taken into account when evaluating the practical risk associated with the recent PHP vulnerabilities.

Nevertheless, we want to emphasize that an on-premises deployment does not automatically eliminate vulnerability-related risks. Systems accessible from an internal network, or through other network access paths, may still be exposed to potential exploitation.

The actual risk therefore depends on each customer's deployment architecture, network configuration, and access controls.

Our ongoing PHP modernization work

QScan currently relies on an older generation of PHP, and upgrading this component has already been part of our ongoing development efforts, well before the recent security announcements.

Modernizing the underlying PHP environment is an important step in the continued evolution of QScan, helping us improve maintainability, compatibility, long-term support, and security.

This work involves more than simply replacing a PHP installation. It requires adapting and validating existing application components, ensuring compatibility across the platform, and carrying out comprehensive regression testing to maintain the reliability of customer workflows.

The important point is that this development work is already underway. We are not starting from scratch in response to the recent vulnerabilities.

The latest security disclosures have further reinforced the importance of completing this transition.

Planned release schedule

Our immediate development roadmap includes two upcoming milestones.

QScan 2026.2 — Expected during the week of 26 October 2026

We are currently finalizing QScan 2026.2, an upcoming release that introduces several interesting new features and improvements to the platform. This release is already approaching completion, and we expect to make it available next week.

PHP modernization update — Targeted a few weeks after QScan 2026.2

Following the release of QScan 2026.2, our development efforts will focus on completing the PHP upgrade, including the compatibility changes and testing required for a reliable production release.

Since substantial work has already been carried out, our current expectation is to make this update available within a few weeks following the release of QScan 2026.2.

This is our current target rather than a confirmed release date, as the final delivery will depend on successful validation and testing.

We recognize the importance of addressing the disclosed security issues and will continue reviewing the implications for supported QScan environments as we complete this work.

Recommendations for QScan customers

While the PHP upgrade is being finalized, we recommend that customers review their QScan deployment and follow standard network security practices.

Avoid direct public internet exposure. QScan's web interface and associated services should not be made publicly accessible unless specifically required and appropriately secured.
Restrict network access. Where possible, limit connectivity to trusted internal networks, authorized systems, or corporate VPN connections using appropriate firewall rules.
Review existing deployments. Customers who have configured external access, internet-facing reverse proxies, or public network forwarding should review those configurations with their IT or security teams.
Maintain network security monitoring. Review relevant security and access logs, particularly where the installation is accessible beyond a tightly controlled internal network.
Apply the upcoming QScan update. Once the updated version is released and validated, we recommend planning its installation promptly.

These recommendations help reduce potential exposure but should not be considered a complete substitute for addressing vulnerabilities in the underlying PHP runtime.

Customers with QScan installations directly accessible from the public internet should review their exposure immediately and contact our support team for assistance with deployment-specific considerations.

Our commitment to customers

Security, reliability, and continuity of operation remain important priorities in QScan's development. We also recognize that many of our customers operate in demanding broadcast, media production, and enterprise environments where stability and predictable software behavior are essential.

Our approach is therefore to deliver a thoroughly tested PHP modernization update that addresses the underlying technology requirements while preserving the stability and functionality customers expect from QScan.

We will communicate further details, including release availability and installation recommendations, as the update progresses. We appreciate your continued trust in QScan and thank you for your understanding.

For any questions regarding your particular deployment or security requirements, please contact the QScan support team.

The QScan Team