OpenFIT has reviewed its application platform, public website and supporting production infrastructure in response to the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Our assessment has not identified any exposure to these vulnerabilities within the OpenFIT application platform or public website. The OpenFIT service remains fully operational, and no customer action is required.
What this means for OpenFIT customers
OpenFIT does not use PHP in its application platform. Our service uses Microsoft .NET server-side technology and a browser-based web application, hosted on Microsoft Azure. Our assessment has not identified affected PHP components in the OpenFIT application or website. No PHP2Shell-specific patching or shutdown is required for these systems.
Supporting business systems
Our review of supporting business applications has not identified any PHP2Shell-related issue affecting delivery of the OpenFIT service.
GroupNos Technologies Ltd, trading as OpenFIT, has also reviewed the business applications including it's website used to support its operations as part of its broader security assessment.
Some of these applications are third-party hosted services whose underlying infrastructure is managed and maintained by their respective providers. Our assessment does not constitute an independent technical inspection of those providers' infrastructure.
We continue to monitor relevant security advisories from our technology and business service providers and will assess any new information for potential implications for our operations or customers.
Customer data protection
We have not identified any exposure to customer data through PHP2Shell within the OpenFIT application platform or public website.
Existing security, authentication, access-control and data-protection measures remain in place.
Service availability
The OpenFIT service remains fully operational and accessible. No service interruption or precautionary shutdown is required as a result of this assessment. Customers do not need to activate contingency procedures for OpenFIT in relation to PHP2Shell.
Ongoing monitoring and updates
We will continue to monitor developments relating to PHP2Shell and update this advisory if new information materially changes our assessment. Customers requiring further clarification on this or any other security, data governance or privacy can contact OpenFIT Support support@openfit.care or dpo@openfit.care .
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article