You may already have heard about PHP2Shell, a security issue announced on 21 October 2026 that affects websites around the world. It involves PHP, a widely used piece of software that runs around three-quarters of the world’s websites. In summary, security experts found two weaknesses in PHP that could theoretically let criminals take control of a website without needing a password.
We want you to know that no Sense products have been affected by this security issue. The software our customers use does not use PHP, so customer accounts have not been at risk due to PHP2Shell, at any point.
However, our marketing websites do use PHP. These are the websites we use to tell people about our products and services, and they can be found here: sense.hr, senseworkplace.com, and sense.tech. And although these websites have no impact on the software our customers use, we wanted to let you know what we have done to keep them safe all the same.
What we did
- 21 October: On the day the issue was announced, we updated our marketing websites to the newest version of PHP available and tightened their security settings. This made an attack harder while we waited for the full fix.
- 22 October: As soon as our hosting provider released the full fix, we installed it on all three websites, which closed both weaknesses. We backed up the websites first, and afterwards we checked that everything was working as normal.
- Checking for a break-in: Attacks were seen around the world from 17 October, a few days before the issue was announced. We checked our websites’ records from that date onwards, and found no signs of a break-in.
All our marketing websites are now protected against this threat, and our checks have confirmed that nothing on our websites was affected.
Do I need to do anything?
Customers of Sense do not need to do anything. Our products and services have worked as normal throughout, and were never affected by this issue in the first place.
If you have any questions about this, please direct your questions to security@sense.hr.