No. On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that could allow an attacker to run code on a server running an affected version of PHP without signing in.

CyberFOX products do not use PHP, so they are not affected by these vulnerabilities. This includes:

• AutoElevate
• CyberFOX Password Manager
• Password Boss
• DNS Filtering
• Timus
• Optimize365

No action is required by our partners or their customers.

After the vulnerabilities were announced, our security team reviewed the software used across our products to confirm this. We continue to monitor new security advisories and will update this page if anything changes. If you have questions, please contact our support team.