TimeTrex Security Update: Our Response to PHP2Shell Vulnerabilities
Summary
TimeTrex responded immediately to the PHP2Shell security vulnerabilities, implementing proactive security measures before official patches became available. All public-facing TimeTrex servers were fully patched within 22 minutes of the security release, with no noticeable disruption to customers. Our subsequent security review found no evidence of attempted exploitation or suspicious activity related to these vulnerabilities.
No action is required for Cloud-Hosted customers. Customers with On-Site installations should ensure their PHP environments are updated. The latest TimeTrex stack installer already includes the necessary security patches.
Detailed Security Response
The following outlines the steps TimeTrex took to assess the PHP2Shell vulnerabilities, implement preventative safeguards, deploy security updates, and verify the security of our infrastructure.
At TimeTrex, protecting our customers' systems and sensitive workforce data is a responsibility we take extremely seriously. When critical security vulnerabilities are disclosed, our priority is to respond quickly and comprehensively while maintaining the reliability and availability of our services.
TimeTrex is developed using PHP, one of the world's most widely used programming languages for web applications, powering approximately 70% of websites with a known server-side programming language. On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities could potentially allow attackers to execute unauthorized code on affected servers.
Because these vulnerabilities affect the underlying technology used by TimeTrex and many other web applications, our team took immediate precautions to protect customer environments, deploy the necessary updates, and minimize operational disruption.
Here is how TimeTrex responded to protect our customers.
Proactive Protection Before Patches Were Available
Within hours of the PHP development team's pre-announcement on the afternoon of October 20, our team began working around the clock to implement additional security measures as guidance became available from security professionals.
Because the PHP development team had indicated that security patches could be released earlier than scheduled if circumstances warranted, we ensured staff were available and actively monitoring developments so we could respond immediately.
As an additional precaution, we proactively implemented perimeter firewall rules to block and log potentially related requests, even when their connection to the vulnerabilities was only a remote possibility. These temporary safeguards provided an additional layer of protection while we prepared to deploy the official security updates.
All Public-Facing Servers Patched Within 22 Minutes
Every public-facing TimeTrex server was fully patched within 22 minutes of the official PHP security updates becoming available on the morning of October 21.
Thanks to our fully redundant, load-balanced infrastructure, we were able to deploy these critical updates across our production environment with no noticeable disruption to our customers.
At the same time, our development team updated the TimeTrex stack installer for On-Site customers to include the patched version of PHP, ensuring customers managing their own installations could also obtain the necessary security updates.
Independent Verification and Security Review
Deploying security patches is only one part of an effective incident response. Following the updates, our team independently verified that every server had been successfully patched at least twice.
We then conducted a thorough review of our traffic logs to identify any indications of attempted exploitation or other suspicious activity associated with these vulnerabilities.
Our review found no evidence of attempted exploitation or suspicious activity related to PHP2Shell.
Only after completing these verification and security checks did we remove the temporary firewall restrictions.
While the additional precautions were in place, certain legitimate operations, including file uploads and other related functions, were temporarily restricted. Customers attempting these operations may have encountered an error message. These restrictions were removed following successful verification.
What TimeTrex Customers Need to Know
Cloud-Hosted Customers: No action is necessary. All required security updates have already been applied to TimeTrex's cloud infrastructure, and our team continues to monitor the situation.
On-Site Customers: Customers using the TimeTrex stack installer can obtain the latest version, which includes the patched PHP release. Customers managing their own PHP environments should ensure the applicable security updates have been installed and verify that their systems are running patched versions.
Our Ongoing Commitment to Security
Security is an ongoing responsibility, not simply a response to newly disclosed vulnerabilities. Our team continues to closely monitor guidance from the PHP development team, security professionals, and the broader security community, and we will take additional action as necessary should new information become available.
Throughout this incident, our focus has remained on responding as quickly and comprehensively as possible, minimizing operational disruption, and maintaining the security and integrity of the TimeTrex platform.
We understand that businesses depend on TimeTrex for critical workforce management, time and attendance, and payroll operations. Protecting those systems and the sensitive information they contain remains a fundamental part of how we develop, maintain, and operate our software.
If you have any questions regarding these vulnerabilities or the security of your TimeTrex installation, please contact our support team. We are happy to assist.
