22/10/2026
This statement provides an update regarding two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell, which were publicly disclosed on 21 October 2026.
It outlines the measures taken by LapSafe® and our infrastructure providers to protect the ONARKEN platform and our customers.
Impact on ONARKEN
PHP is one of the technologies used within the ONARKEN cloud platform. As such, the relevant ONARKEN cloud services were within the scope of these vulnerabilities and required the appropriate security updates.
All ONARKEN cloud applications are hosted on Laravel Cloud, a managed application hosting platform responsible for maintaining the underlying PHP runtime and coordinating associated infrastructure security updates.
Protective Measures – Cloudflare
As part of LapSafe®'s layered approach to infrastructure security, ONARKEN cloud services operate behind Cloudflare.
Cloudflare confirmed that it proactively developed and deployed additional Web Application Firewall (WAF) protections specifically designed to mitigate potential exploitation of these vulnerabilities.
These protections were deployed ahead of public disclosure, providing an additional layer of defence while the necessary PHP security updates were being released and applied.
LapSafe® independently verified that the relevant Cloudflare WAF protections were active for ONARKEN cloud services.
These measures provided additional protection and complemented the required PHP security updates.
Further information is available in Cloudflare's official security announcement
Security Patching and Remediation
The official PHP security updates were released at 13:40 UTC (14:40 BST) on 21 October 2026.
Following their release, Laravel Cloud coordinated the deployment of updated PHP runtimes across its managed hosting infrastructure.
At 19:47 BST on 21 October 2026, Laravel Cloud officially confirmed that the security updates had been successfully applied across all its hosting regions, including all running applications.
LapSafe® can therefore confirm that the relevant security patches have been successfully applied to all ONARKEN cloud services, with remediation completed on 21 October 2026, the same day the vulnerabilities were publicly disclosed.
The updates were applied through the managed cloud infrastructure without requiring application redeployment or action from ONARKEN customers.
ONARKEN Smart Locker Software
The ONARKEN Smart Locker Software installed locally on customer premises does not include or utilise PHP and was therefore not directly affected by these vulnerabilities.
No software updates or remedial action are required on customer Smart Locker installations in relation to this advisory.
Security Investigation
LapSafe® continues to work closely with our managed cloud hosting provider, Laravel Cloud, to monitor developments relating to these vulnerabilities and assess any potential impact on the ONARKEN platform.
At the time of this communication, LapSafe® has identified no evidence of successful exploitation of these vulnerabilities affecting ONARKEN services.
We will continue to monitor the situation alongside our infrastructure providers and review any relevant security information as it becomes available. Should any material findings arise that affect ONARKEN or our customers, we will communicate these accordingly.
Our Commitment to Security
The security and integrity of our customers' systems and data remain a priority for LapSafe®.
Our approach combines managed infrastructure security, protective measures at the network edge, ongoing vulnerability monitoring and verification of security updates to minimise exposure to emerging threats.
LapSafe® will continue to monitor relevant security advisories and work closely with our infrastructure providers to maintain the security of ONARKEN and our customers' services.
Should you have any questions or require further information, please contact the LapSafe® support team.