WinAir Unaffected by PHP2Shell Vulnerabilities, Public Websites Secured and Patched the Same Day

London, Ontario | October 26, 2026

WinAir has confirmed that its aviation maintenance and inventory management software is not affected by PHP2Shell, a pair of critical vulnerabilities in the PHP programming language that let an attacker run code on a server with a crafted HTTP request, without signing in. WinAir installations required no action from customers.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP rates both 9.2 (critical). Full details are available from the U.S. National Vulnerability Database:

• https://nvd.nist.gov/vuln/detail/cve-2026-109618

• https://nvd.nist.gov/vuln/detail/cve-2026-109619

The WinAir platform does not use PHP, which places it outside the scope of these vulnerabilities.

Two of WinAir’s public websites, winair.ca and hub.winair.ca, do run on PHP. The WinAir team put interim protective measures in place on both sites at 9:00 a.m. ET on October 21 while an official fix was pending, then applied the patch at 3:00 p.m. the same day. Both sites were fully patched within six hours of the team’s initial response. A review of server logs found no evidence of suspicious activity.

Protecting the security of your data is our top priority. We continuously monitor for emerging threats and will keep you informed of any developments that may affect your organization.

Aaron Webster
Director of Software Development

Jayson Exel
Cybersecurity Analyst