On 21 October PHP released fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619. They are often called PHP2Shell. Both let someone run their own code on a server that runs PHP. Several clubs have asked us if Equipe is affected.

Equipe does not use PHP

None of the services we run use PHP, directly or indirectly. There is nothing to patch on our side and nothing you need to do in Equipe.

  • app.equipe.com, entry.equipe.com, online.equipe.com, logo.equipe.com and help.equipe.com are built with Ruby on Rails.
  • Live results updates run on AnyCable, written in Go.
  • monitor.equipe.com and status.equipe.com, our error tracking and status page, are written in Rust.
  • analytics.equipe.com, our visitor statistics, is Plausible, written in Elixir.
  • policies.equipe.com and api-docs.equipe.com are static pages with no code running behind them.

If you have built something on top of Equipe

Many of you have built extensions, timing and scoreboard integrations, or websites that read from our API. If any of that runs on PHP, update PHP now. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix from PHP, so they need to move to a supported version.

Many of you started from our PHP example for extensions. The code in it does not need to change. The PHP it runs on does.

If a web host runs PHP for you, ask them to confirm the update is done.

If you can't update right away, PHP's advisory lists settings that make an attack harder. PHP is clear that only an update makes a server safe.

If your server was open before you updated

On some setups the attack works without a login, before any of your own code runs. If your server ran an old PHP and was open to the internet, change the secrets it holds: the Equipe API key and the extension secret. Email us at info@equipe.com and we'll help you swap them.

Check what your club runs

Equipe is only one of the systems your club uses. Go through the others too: your website, membership and booking systems, online shop and anything else open to the internet. Many of them run on PHP, and WordPress is the best known example. Ask whoever runs each one to confirm it has been updated.

If your website shows our start lists or results, that part comes from our servers. The website itself still needs checking.

Questions, or a supplier form you need filled in? Email info@equipe.com.