Baseform is not affected by the PHP2Shell vulnerabilities

This week, two critical vulnerabilities in the PHP runtime, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), were disclosed. They allow remote code execution on servers running PHP, and organisations around the world have been rushing to patch or take affected systems offline.

We want to reassure our customers and partners: the Baseform platform is not affected by this incident in any way. Baseform is not built on PHP, does not run PHP anywhere in its platform, and does not depend on PHP components. No action is required from Baseform users.

How we approach security

Water utilities trust Baseform with data about critical infrastructure, and we take that responsibility very seriously. Security is part of how we build and run the platform every day, not something we turn to only when an incident makes headlines:

• Independent testing. Accredited third parties test the Baseform platform regularly.
• Internal testing. Our own team tests the platform as part of its regular development and operations work.
• Continuous scanning. We continuously scan our systems for known vulnerabilities and exploits, so we can find and fix issues quickly as they emerge.

Incidents like this are a reminder of how important it is for utilities to know the security posture of every system they depend on. If you have questions about Baseform’s security practices, or need documentation for your own security or compliance reviews, please contact us.