In this article
We have completed the security update on our servers, which are used, for example, to run our website, to fix two PHP vulnerabilities. Banana Accounting software, however, is not affected by these vulnerabilities.
Two major security vulnerabilities have recently been identified in PHP, a programming language used by many websites and web services. These security flaws affect PHP's memory management and, under certain conditions, may allow remote code execution, meaning that attackers could execute malicious code on affected servers.
To protect our web services from these potential risks, we have completed the necessary security updates on all our servers. Specifically, the required security patches have been applied to fix the following vulnerabilities:
- CVE-2026-109618 - RCE via OOM Corruption
- CVE-2026-109619 - RCE via Stale Global State
Banana Accounting, both the current version and previous versions, is not and has never been affected by these vulnerabilities, because our software is a desktop application and therefore does not use PHP.
Banana Accounting users therefore do not need to take any action regarding the software.
For more technical information, please refer to the advisory issued by the Swiss Federal Office for Cybersecurity.