PHP vulnerability: status update
Dear Customers,
As you might have read, AI systems recently discovered a vulnerability in PHP. As a matter of course, our IT team is fully aware of the situation and is double-checking how it might affect any of the internal or external solutions we provide.
Status as of 22/10/2026: No incidents have been discovered. ONEsignage (hosted by at-visions) is fully patched and the CVEs are closed. Security fixes for ONEsignage on-premise and ONEsquare are finished and currently in QA, with automatic rollout starting at the beginning of next week. No service impact is expected.
All other systems (ONEapp, ONEspeed, osq1, isq7) are not affected.
Update · 22/10/2026, 15:10 CET
- ONEsignage (hosted by at-visions): all patches have been successfully applied and the CVEs are closed.
- ONEsignage on-premise and ONEsquare: security fixes are finished and QA is currently running. As these systems are not publicly reachable, the impact of this CVE is minimal. We are focusing on QA and will start the automatic rollout at the beginning of next week. No service impact is expected.
Update · 22/10/2026, 14:00 CET
After a detailed review of our complete solution landscape and version history, the only potentially affected solutions are:
- ONEsquare Hotel IPTV
- ONEsignage Digital Signage
To further minimise any PHP-related risk, we have already developed appropriate countermeasures and are currently rolling them out.
All other systems (ONEapp, ONEspeed, osq1, isq7) are not affected.
Our recommendation
We highly recommend checking your overall system landscape to identify any potential attack surface resulting from this PHP exploit. This is not restricted to websites and may also affect various other solutions in your overall tech stack.
Questions? Contact us at contact@at-visions.com or +43.3356.732.71.
Last updated: 22 October 2026