Overview
When a critical vulnerability in PHP becomes public, customers regularly ask whether Password Secure is affected. This applies in particular to the vulnerability also known as php2shell. This article answers that question and explains which parts of your environment you still need to check yourself.
Key Points
Password Secure and PHP
None of the components of Password Secure use or require PHP. This includes the Server Manager, the Windows App, the Web App, the Mobile App and the browser extension. Vulnerabilities in PHP therefore do not affect Password Secure itself, and no update or patch for Password Secure is required in response to them.
What you should check in your environment
PHP may still be present on systems that run alongside Password Secure, for example on a web server or reverse proxy in front of the Web App or on the same server. Whether a vulnerable PHP version is in use there is outside the scope of Password Secure. Check these systems with the administrators responsible for them and apply the fixes recommended by the PHP project or your vendor.
Note: If you need a statement for your own security or compliance assessment, you can quote the answer above. For further questions, create a support ticket.