Security Announcement on WID-SEC-2026-4055

​​We will update this announcement with new details as they emerge from our analysis. Please check back periodically.

Last update: 22.10.2026, 16:30 PM CET

Statement on WID-SEC-2026-4055 (PHP)

This advisory concerns two critical vulnerabilities in the PHP programming language, CVE-2026-109618 and CVE-2026-109619.

Our product lines – enaio®, yuuvis® RAD and yuuvis® Momentum – are not affected.

We have checked the Software Bills of Materials (SBOMs) for all currently supported versions, including the container images provided. None of our products contain a PHP runtime environment or PHP components.

The PHP project published the technical details and affected versions with the security release on 21 October 2026.

Please note:

This statement applies to OPTIMAL SYSTEMS products. If you run your own PHP-based applications in your environment, such as intranets, portals or content management systems (CMS), we recommend that you check these separately and apply updates promptly.

Information from our partner Insiders Technologies

The Insiders Cloud and our standard software smart FIX and OmnIA in on-premises deployments are not affected.

However, our HelpCenter and Insiders Insights were affected. As a precaution, we took the HelpCenter offline until the patch had been applied. It has been available again since 22 October 2026, 07:00 CET. Insiders Insights was also updated immediately. We have no indication that the vulnerabilities were exploited before the update. Your data was not at risk at any time, as both systems are operated separately from the Insiders Cloud. No action is required on your part.