PHP2Shell Vulnerabilities: Final Impact Assessment and Response
Updated 23 October 2026
Further to our initial impact assessment published on 22 October 2026, Sagacity has concluded our comprehensive review. This update constitutes our final position in respect of the PHP2Shell vulnerabilities and sets out the methodology adopted, the findings of our assessment, and the implications for the clients we serve. This statement will remain under active review and will be updated should material changes arise.
Review Methodology
Our assessment was conducted on a systematic, inventory-based basis. The methodology framed our review around four principal questions:
Where might PHP be present across our enterprise technology estate?
Where does Sagacity hold accountability for operating infrastructure on behalf of our clients?
Which of our material third-party suppliers and sub-processors process data or deliver services on our behalf, and what is their stated position?
Are there any indicators within our environments suggestive of attempted exploitation?
Scope of Review
The scope of our review encompassed:
Our enterprise technology estate, comprising the devices, servers, applications, and development projects that constitute our day-to-day operational environment
Sagacity Dot and our family of client-facing platforms, built and operated by Sagacity on behalf of our clients
Managed service environments operated on behalf of specific clients, each assessed on its own terms with environment-specific engagement conducted where required
The sagacitysolutions.co.uk website and our wider marketing infrastructure
Our material third-party suppliers and sub-processors, through a combination of their published positions and direct written assurance requests issued by Sagacity
Findings
Sagacity Dot and our core client platforms are not affected: Our client-facing platforms are constructed upon technologies that do not incorporate PHP, and no PHP2Shell exposure has been identified.
No PHP2Shell exposure has been identified across our Sagacity-operated environments: A single legacy internal application was identified during our review and has been retired and decommissioned as part of our response.
No indicators of attempted exploitation have been identified during the review period: Enhanced monitoring remains in place to detect any change in this position.
Our material third-party suppliers have either confirmed that they are not affected or have mitigations in place: We continue to pursue written assurance from any supplier that has not yet published a formal position, and we are tracking vendor advisories as the situation develops.
Implications for our Clients
For clients using Sagacity Dot and our managed platforms, no action is required in respect of Sagacity-operated systems. Normal service continues without interruption.
Ongoing Posture
PHP2Shell represents a vulnerability profile that will develop over weeks and months rather than days. Whilst patches are available, active opportunistic scanning for exposed systems is being observed across the internet, and vendor positions will continue to evolve as deeper investigations complete.
Our monitoring continues. This statement will be updated should the position change materially, and we will engage directly with any client requiring further action in respect of systems operated by Sagacity on their behalf.
Enquiries
Enquiries regarding PHP2Shell or our response may be directed to info@sagacitysolutions.co.uk