On October 21, 2026, the PHP Foundation released critical security updates for CVE-2026-109618 and CVE-2026-109619, vulnerabilities collectively known as PHP2Shell. We applied the relevant security updates to Source Elements services that day.
We can confirm that Source Elements services were not compromised by these vulnerabilities. Our review found no evidence that PHP2Shell was exploited in our infrastructure.
Current Source Elements products were not affected
Source-Connect 4, Source-Nexus, and Source-Nexus Gateway were not affected by PHP2Shell. These current products remain the supported path for secure, modern remote production workflows.
What this means for Source-Connect 3 users
Source-Connect 3.9 and earlier are legacy products. They were designed for an earlier generation of operating systems, services, and security standards. As the wider internet moves quickly to address critical vulnerabilities like PHP2Shell, continuing to rely on legacy software creates an increasingly unacceptable security and compatibility risk.
We cannot assure the security posture of a workstation or production workflow that remains on Source-Connect 3.9 or an earlier release. These versions do not provide the security foundation expected for an actively connected production environment today.
Our recommendation: upgrade to Source-Connect 4
Source-Connect 4 is the current, actively supported generation of Source-Connect. It is built for modern operating systems and current security practices, and is the supported path for secure remote recording workflows.
- Move from Source-Connect 3.9 or earlier to Source-Connect 4 as soon as possible.
- Do not keep a legacy installation in an active workflow simply because it still opens or connects.
- Contact Source Elements Support if you need help planning your upgrade.
About PHP2Shell
PHP2Shell refers to two critical PHP vulnerabilities that can allow remote code execution in affected environments. The U.S. National Security Agency has advised organizations to apply the available patches promptly. While our services were patched and were not compromised, this event is an important reminder that current software and supported security updates are essential to protecting production systems.