Issue
On October 21, 2026, a vulnerability in PHP known as PHP2Shell was disclosed (CVE-2026-109618, CVE-2026-109619). The XPressEntry Web Console runs on PHP, so on-premise installations of the Web Console are affected. The rest of XPressEntry, including handhelds and partner integrations, doesn’t use PHP.
Exposure
- Hosted customers (XPressEntry.com): not affected. All hosted sites were patched by 12:00 PM PT on October 21.
- On-premise customers without the Web Console: not affected.
- On-premise customers with the Web Console installed: affected if the Web Console version is earlier than 1.4.7.350, which bundles PHP earlier than 8.3.36.
To check whether you have the Web Console and which version:
- Installed apps (Settings → Apps, or Programs and Features): find XPressEntry Web and look at its version.
- Or, from a command prompt, run
C:\XPressEntryWeb\php\php.exe -v. Anything earlier than PHP 8.3.36 needs the update.
If XPressEntry Web isn’t listed and there’s no XPressEntryWebService service, the Web Console isn’t installed.
Status
PHP released a patch at about 7:00 AM PT on October 21. Telaeris patched every hosted site by 12:00 PM PT. The same day, Telaeris released XPressEntry 3.7.7848, which includes Web Console 1.4.7.350 with PHP 8.3.36. Our team reviewed access logs for every hosted site covering the period between disclosure and patching, and found no indication that the vulnerability was exploited. We have also received no reports of exploitation from on-premise customers. If that changes, we will contact affected customers directly.
Recommended actions
- Upgrade XPressEntry and the Web Console. Download XPressEntry 3.7.7848 or later from the Telaeris downloads page and run the installer. On the installer’s final screen, make sure Install Web Console is checked so the updated Web Console (1.4.7.350) is installed too. The Web Console ships with its own copy of PHP, so installing it replaces PHP with the patched version. You don’t need to install or patch PHP separately.
- If you can’t upgrade right away, disable the Web Console until you can. In the Windows Services console, stop these four services and set their startup type to Disabled:
- XPressEntryWebService
- XPressEntryQueue
- XPressEntryScheduler
- XPressEntryCentrifugo
Handhelds and partner integrations don’t depend on the Web Console, so they keep running.
- After upgrading, set the four services back to Automatic and make sure they’re running.
Additional hardening
- Don’t expose the Web Console to the internet. Limit access to the networks and users that need it.
- Restrict network access to the XPressEntry server to known clients and reader endpoints.
Frequently asked questions
Was any of our data exposed?
We reviewed access logs for every hosted site covering the period between disclosure and patching, and found no indication that the vulnerability was exploited. We have also received no reports of exploitation from on-premise customers.
Does updating XPressEntry fix the PHP vulnerability?
Yes, as long as the updated Web Console is installed too. The Web Console ships with its own copy of PHP in C:\XPressEntryWeb\php. Installing Web Console 1.4.7.350, which is included with XPressEntry 3.7.7848, replaces it with the patched PHP 8.3.36. You don’t need to install or patch PHP separately.
How do I tell if I’m affected?
Look for XPressEntry Web in Installed apps (Settings → Apps, or Programs and Features). If it’s listed with a version earlier than 1.4.7.350, you’re affected. You can also run C:\XPressEntryWeb\php\php.exe -v from a command prompt: anything earlier than PHP 8.3.36 needs the update. If XPressEntry Web isn’t listed and there’s no XPressEntryWebService service, the Web Console isn’t installed and you’re not affected.
How do I disable the Web Console until I can update?
In the Windows Services console, stop the four Web Console services listed under Recommended actions and set their startup type to Disabled. Handhelds and partner integrations don’t depend on the Web Console, so they keep running. After you update, set the services back to Automatic and start them.
Which versions are affected?
All XPressEntry Web Console versions before 1.4.7.350, which bundle PHP earlier than 8.3.36. The fix is in Web Console 1.4.7.350, included with XPressEntry 3.7.7848.
Contact
If you need help upgrading, or you support a government, critical-infrastructure or otherwise regulated customer with contractual notification obligations, contact us through the Telaeris helpdesk.