Context

Critical vulnerabilities affecting PHP have recently been disclosed and published under CVE-2026-109618 and CVE-2026-109619. Several national cyber security agencies have issued advisories recommending that organisations identify and update any systems running affected PHP versions.

As part of these assessments, customers' security teams are reviewing third-party solutions installed in or connected to their SAP and SAP SuccessFactors landscapes, and some have asked SpinifexIT to confirm whether its products use PHP in any layer, including the presentation layer.

SpinifexIT official answer 

SpinifexIT solutions

SpinifexIT has reviewed its product portfolio and confirms that none of its products or solutions use PHP directly, and they are therefore not impacted by CVE-2026-109618 or CVE-2026-109619.

• Easy Suite products (SAP on-premise): Easy Reporter, Easy Documents, Easy PayInsights, Easy Clone and the other Easy Suite products are developed in SAP ABAP and run entirely within the customer's SAP system. They contain no PHP code and have no dependency on a PHP runtime.
   
• SpinifexIT Web solutions: the web-based solutions (including Web Reporting, the Easy Reporter Web interface, Easy PayInsights Web solution and Dashboards) do not use PHP in their presentation or application layers.
   
• SpinifexIT Web Services and Integration components: the Remote Activation service and the SpinifexIT Authentication method for SAP SuccessFactors do not use PHP.
   

However, not directly related the solutions , SpinifexIT official website was down for half an hour, including the HTML pages that appear on the home page of the products (if you have that format activated in your system) due to the risk of the vulnerability.  See below.

Other available resources 

• SpinifexIT official website was down for half and hour and was upgraded to the PHP 8.3 version containing the fixes for the identified vulnerabilities 
• the SpinifexIT Help Center (hosted by Zendesk) was not impacted. 

Note: This statement covers SpinifexIT products and solutions only. Customers should continue to assess and update any other systems in their landscape (for example web servers, portals or third-party applications) that may run an affected PHP version, in line with their internal security policies and the vendor advisories for those systems.