Pro Cloud Server and PHP

[RobCDeJong]

Is PHP used only by WebEa within Pro Cloud Server?
Can we safely keep using Pro Cloud Server when we disable WebEA?

[Eve]

I'll give you the answer provided to people who emailed support.

Two critical vulnerabilities in PHP have been announced. CVE-2026-109618 and CVE-2026-109619.

https://www.php.net/archive/2026.php#2026-10-21-5

In summary:

• The vulnerabilities impact all versions of PHP from version 5.4
• The only complete solution is to update to one of the following versions: 8.5.12, 8.4.27.
• This is an error in PHP itself that is triggered before reaching any application code (such as WebEA.)

Sparx Systems is aware of these vulnerabilities. The following summarizes how this impacts our software:

• WebEA and the PCS Web management run on PHP and require a minimum version of PHP 8.4.
• While there are some ways to reduce your exposure, the only complete solution is to update PHP.
• No setting within WebEA or PCS will have any impact on the vulnerability.
• We do not build, bundle, or distribute PHP. It needs to be updated separately.
• No update to PCS or WebEA is required to make use of the fixed PHP version.

The updates for all PHP versions that are supported by WebEA were released and available before your post. If for any reason you can't update it anyway, the only way to be safe would be to disable PHP completely on your web server.