On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in the PHP language runtime, CVE-2026-109618 and CVE-2026-109619, commonly referred to as "PHP2Shell." Both are rated Critical (CVSS v4.0 9.2) and can allow an unauthenticated attacker to run code on web servers that use PHP. CISA and other national security agencies have urged organizations that run PHP to patch immediately. On October 23, the PHP project also disclosed a related, lower-likelihood issue, CVE-2026-115560, that affects only unusually configured PHP applications.
Cook Solutions Group's IT and Compliance teams have reviewed our websites and confirmed that none of them use PHP. Because these vulnerabilities exist only in the PHP runtime, our websites are not affected, and no action is required by our customers with respect to Cook Solutions Group websites.
We also contacted our alarm monitoring partner, COPS Monitoring, which has confirmed that its MPower platform is not affected by these vulnerabilities.
DMP has also confirmed that Virtual Keypad, Dealer Admin, SCS-VR, Entré and DMP cameras are not affected by these vulnerabilities.
We continue to monitor guidance from the PHP project, CISA and our technology vendors, and will update this notice if our assessment changes. Technical details are available in the PHP security announcement and the CISA alert.
If you have any questions, please contact our Support team at support@cooksolutionsgroup.com.