VeraLab Security Advisories
Security advisories for VeraLab and License Patrol: publicly reported vulnerabilities, whether they affect our products, and the releases that fix them. For questions, or a written confirmation on company letterhead for your records, contact support@veralab.com.
| Advisory | Date | Status |
|---|---|---|
| PHP2Shell (CVE-2026-109618, CVE-2026-109619) | October 22, 2026 | Not affected |
| Apache Tomcat 11.0.27 security update | October 20, 2026 | Fixed in 26.1.5 |
PHP2Shell (CVE-2026-109618, CVE-2026-109619): VeraLab and License Patrol Are Not Affected
PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution. They affect only systems that run PHP.
VeraLab and License Patrol do not use, include or install PHP in any of their components:
- VeraLab Server is a Java web application that runs on Apache Tomcat, a Java servlet container. No PHP interpreter, PHP-FPM or PHP modules are bundled with it or required by it.
- VeraLab Guard Client for Windows and macOS is a native workstation agent and contains no PHP.
- License Patrol follows the same architecture and does not use PHP.
If the server that hosts VeraLab or License Patrol also runs other software that uses PHP, that software needs to be assessed separately. The VeraLab and License Patrol installations themselves have no exposure to this issue.
VeraLab and License Patrol 26.1.5: Apache Tomcat 11.0.27 Security Update
VeraLab and License Patrol 26.1.5 update the embedded Apache Tomcat to version 11.0.27, which addresses the following Tomcat vulnerabilities:
- CVE-2026-103119
- CVE-2026-101356
- CVE-2026-101296
- CVE-2026-93446
- CVE-2026-88041
- CVE-2026-74049
- CVE-2026-74048
We recommend that all customers running VeraLab or License Patrol 26.1 upgrade to 26.1.5. Download it from the VeraLab or License Patrol downloads page. Upgrading to VeraLab 26.1 and later requires an active Extended Support agreement; contact sales@veralab.com if you are unsure of your status.
See also: release notes for all versions.
