PHP2Shell (CVE-2026-109618, CVE-2026-109619): does it affect Revit and Civil 3D plugins?
PHP patched two critical flaws (PHP2Shell) on October 21, 2026. Why they don't reach your Revit and Civil 3D plugins, where they do, and what to do today.
Security · Revit · Civil 3D
PHP2Shell: the critical PHP flaw doesn't reach your Civil 3D and Revit plugins, but it can reach your firm
What was patched on October 21, 2026, where an engineering firm runs PHP, the one case where a plugin is exposed, and what to do today.
What happened with PHP on October 21, 2026?
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical flaws: CVE-2026-109618 and CVE-2026-109619, scored 9.2 in CVSS v4.0. They allow code to run on the server without logging in. They're known as PHP2Shell.
They affect every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The official advisory is blunt: there's no complete mitigation, and updating is the only safe choice. PHP 8.1 and older no longer get fixes from the PHP project, and CISA recommends taking those systems offline until they're updated.
Does it affect Civil 3D and Revit plugins?
No. A C# plugin is a .dll file that Revit or Civil 3D loads at startup. It runs inside the program, on your computer, on .NET. PHP isn't involved. The same goes for Dynamo scripts and AutoLISP routines.
A plugin's security depends on other things: its libraries, the .NET version it runs on and where it's installed from. We cover that in Revit and Civil 3D plugin security.
Where can it hit an engineering firm?
Anything that runs as a PHP website:
- Your company website, especially if it's built on WordPress.
- The intranet or the portal where drawings and documents are shared.
- An internal system on an in-house server nobody updates.
- A commercial plugin vendor's server, if licenses or updates come from it.
The last case is the only one that reaches a plugin. If that server is compromised, it could hand out a tampered installer. That's why it's worth knowing where your plugins update from and whether their installers are signed.
What should you do today?
- List your PHP websites and servers: website, intranet, portals and internal systems.
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your hosting provider to confirm it's done.
- If you run PHP 8.1 or older, contact your vendor or take the system offline until it's updated.
- Ask each commercial plugin vendor where their licensing and updates run, and whether they've patched.
- Review your custom plugins: libraries, .NET version and digital signature.
Sources
- PHP security advisory: fixed versions, affected installations and mitigations (October 21, 2026).
- CISA alert on the PHP vulnerabilities (October 21, 2026).
Facts verified on October 21, 2026.
Related resources
- How to secure a plugin: Revit and Civil 3D plugin security.
- How one gets built: Revit and Civil 3D add-in development, the complete guide.
- To budget for it: how much a Revit or Civil 3D add-in costs.
Frequently asked questions about PHP2Shell and your plugins
Does the PHP vulnerability affect Revit or Civil 3D?
No. Revit and Civil 3D are Windows desktop programs, and their C# plugins run on .NET, not PHP. CVE-2026-109618 and CVE-2026-109619 affect web servers running PHP, such as your firm's website or intranet, document portals or license servers.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. PHP 8.1 and older no longer get fixes from the PHP project: contact your vendor or take the system offline until it's updated, as CISA recommends.
Can my Revit or Civil 3D plugin be affected in any way?
Only indirectly: if the plugin downloads licenses, data or updates from a PHP server and that server is compromised, it could hand out a tampered installer. Ask the vendor where that server runs and whether it's patched, and prefer plugins with a signed installer.
What is PHP2Shell?
It's the name given to the two critical PHP flaws patched on October 21, 2026, CVE-2026-109618 and CVE-2026-109619, scored 9.2 in CVSS v4.0. They allow code to run on a web server without logging in.
Who reviews the security of Revit and Civil 3D plugins?
At Zeist we build and maintain C# plugins for Revit and Civil 3D: we check their libraries, the .NET version they run on, their digital signature and where they update from. The diagnosis is free and takes one week.
Keep reading on this topic
Revit and Civil 3D Add-in Development: The Complete Guide (2026)
The complete guide to Revit and Civil 3D add-in development: what add-ins are, what to automate, C# and the Autodesk API, deployment and cost.
How to Build a Civil 3D Plugin with Claude Code Without Being a Programmer: End-to-End 2026 Guide
How to build a Civil 3D plugin with Claude Code without coding experience: architecture, prompts that work, and how to compile and deploy it.
Dynamo vs C# in Civil 3D and Revit: when to use each + automations that save hours
Dynamo or C# for automating Civil 3D and Revit: the real differences, when each one is worth it, and automations that save hours, with examples.
How much does a Revit or Civil 3D add-in cost? 2026 pricing and timeline guide
How much a Revit or Civil 3D add-in costs to build: what drives price and timeline, and how to calculate whether it pays for itself in hours saved.