Milestone’s XProtect, Arcules, BriefCam, Project Hafnia, and brighter AI are not affected by the PHP2Shell vulnerabilities.
Following the news of the PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Milestone has assessed its products and technology for potential exposure.
The security assessment found that XProtect, Arcules, BriefCam, Project Hafnia, and brighter AI are not affected.
No action is required for users of XProtect, Arcules, BriefCam, Project Hafnia, and brighter AI in relation to the PHP2Shell vulnerabilities, and they can continue using these products.
The Milestone Evidence Manager, an extension to XProtect, currently uses a vulnerable version of PHP. Milestone advises all users of Evidence Manager to upgrade their installation to PHP to version 8.2.35 using the following steps:
Milestone will continue to monitor the situation closely and will provide updates should new relevant information become available.