🛡️ Security Advisories
Security advisories affecting Exivity, newest first.
PHP2Shell (CVE-2026-109618, CVE-2026-109619)
October 21, 2026
The fix is available in Exivity Core v3.39.3, which updates the bundled PHP runtime to 8.4.27 for both Kubernetes deployments and Windows installations. Upgrade every Exivity Core instance. Keep the precautions below in place until each instance runs v3.39.3.
PHP has announced an urgent security release for two critical vulnerabilities, known as "PHP2Shell", that may allow remote code execution. Exivity Proximity runs on PHP, so we are treating this as a potential exposure. There is no indication that any customer environment has been compromised.
The fix will ship as an Exivity update. Do not replace PHP in the Proximity image or installation yourself. Release and upgrade instructions will follow separately.
What to do now
Until the update is applied, remove public access to Proximity or restrict it to trusted networks or a VPN. If you cannot isolate it, consider stopping the Proximity API until the update is available, in line with the CERT-EU advisory.
- Kubernetes: restrict access at your ingress controller, API gateway or network policies, and make sure no other load balancer or exposed service can bypass it. Otherwise, stop the Proximity API workload.
- Windows: restrict access with your perimeter firewall, Windows Firewall or reverse proxy, covering both the web entry point and any directly reachable API ports. Otherwise, stop the Proximity API service.
This may interrupt access to the Exivity interface and API integrations, so coordinate with your infrastructure team.
Additional filtering
If your ingress, reverse proxy or API gateway allows it, reject requests on all Proximity routes whose Content-Type contains multipart/. This blocks the reported upload attack path. It also disables multipart data-file imports, and it has not been confirmed to cover both vulnerabilities. Use it in addition to isolation, not instead of it.
CORS, API authentication and maintenance pages do not protect against this, because PHP processes the request before any Exivity checks run.
For deployment-specific guidance, contact support@exivity.com.
CVE-2021-44228
December 10, 2021
Exivity does not ship any Java-powered software components. As such the Exivity software solution is not affected by CVE-2021-44228. For more information regarding this matter, please file a request at the Exivity support portal or send an e-mail to support@exivity.com.