Action required: Update PHP used by your WebEA installation

Two critical vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) require immediate updates.

As WebEA relies on PHP, customers operating their own WebEA installation should ask their IT administrator or hosting provider to update the underlying PHP environment immediately, particularly where it is accessible from the internet.

We would like to draw your immediate attention to two recently disclosed critical security vulnerabilities in PHP, commonly referred to as PHP2Shell:

  • CVE-2026-109618
  • CVE-2026-109619

Both vulnerabilities are rated Critical (CVSS 9.2) and may allow unauthenticated attackers to execute malicious code on affected web servers.

Why does it matter for you?

As a user of Sparx Systems Pro Cloud Server, you may also be using WebEA, the browser-based interface for accessing Enterprise Architect models.

WebEA relies on PHP as part of its underlying web server infrastructure.

PHP itself is not supplied as part of the Pro Cloud Server installation and must be installed, configured and maintained separately by the customer or their hosting provider.

Consequently, installations using affected PHP versions may be exposed to these vulnerabilities, particularly if WebEA is accessible from the public internet.

Immediate action required

We strongly recommend that you ask your IT or security team to:

    1. Verify whether WebEA is installed and actively used in your Pro Cloud Server environment.
    2. Identify the PHP version used by the web server hosting WebEA.
    3. Immediately update PHP to a security-patched, supported version addressing CVE-2026-109618 and CVE-2026-109619.
    4. Prioritise publicly accessible installations, as these may be particularly exposed to unauthenticated attacks.
    5. If an immediate update is not possible, temporarily restrict external access to affected installations until remediation has been completed.
    6. Review relevant server and security logs for indications of suspicious activity.

The PHP project released security fixes on 21 October 2026. Please coordinate the update with your IT administrator or hosting provider and verify compatibility with your WebEA version.

Important clarification

This advisory does not indicate that a vulnerability has been identified in Sparx Systems Pro Cloud Server itself.

The reported vulnerabilities affect PHP, an external software dependency required for running WebEA.

Since we do not manage the PHP installations in customer-operated environments, we cannot determine whether your installation is affected. We are therefore informing all Pro Cloud Server customers as a precaution.

Further information

PHP security releases:
https://www.php.net/

Official Sparx Systems WebEA documentation:
https://sparxsystems.com/enterprise_architect_user_guide/17.2/the_model_repository/webea_website.html