- Data security
- System updates
PHP vulnerability: VAULO is not affected
Two serious PHP vulnerabilities, known as PHP2Shell, affect many websites. VAULO is not affected. Here's how you keep sharing files with your agency, the press and partners.
On October 21, 2026, two serious security vulnerabilities in PHP became public. Reports call them "PHP2Shell". PHP is software that a huge number of websites and online tools run on. Authorities such as Germany's Federal Office for Information Security (BSI) advise installing the updates right away.
For VAULO, the answer is simple: the platform is not affected. You can keep sharing, receiving and reviewing files just as you always do.
What does this mean for you?
Some websites and tools may have to go offline for a short time until they are updated. So ask your IT team or your hosting provider whether your website and your tools already have the update.
Do you use the VAULO plugin for WordPress or the VAULO extension for TYPO3? Then your website isn't hosted by VAULO, but on your own server or by your hosting provider. That server needs the PHP update, and your IT team or hosting provider takes care of it.
You'll find the technical details for your IT team in the box at the end.
Keep sharing with VAULO
If a tool you normally use to exchange files is offline until it's updated, you can use VAULO in the meantime.
The agency needs the layouts
You put the files in VAULO and send the agency a share link, which you can protect with a password and an expiry date if you like. The agency opens it in the browser. They don't need an account.
The press wants material
For the press, you share an entire folder with one link. For a presentation, you decide whether downloads are allowed. In the overview of your shared links, you can see how often a link has been opened.
The photographer delivers the event photos
With ExternalUpload, the photographer gets their own upload page. They use it to upload the photos straight into the folder you've chosen. They don't need an account, and they can't see any of your other content. At events, it even works straight from the camera: with LiveUpload, the camera sends the photos to VAULO via FTP.
A partner needs to upload files
Suppliers and partners use the same route. You send them the link to the upload page, and the files land in the folder you've set up for them.
Feedback right on the file
The agency has notes on the design? In review mode, recipients comment on images and videos, draw on them and add labels and stars. You see it all instantly in VAULO, right on the file in question.
Everything neatly organized
Every file sits in a folder, every folder in a Space, and every Space in your organization. Permissions apply from the top down: a role on a Space automatically applies to all the folders in it. VAULO handles all common formats, from images and videos to PDFs and Office documents.
Update first, keep working with VAULO
Get the PHP updates installed first. If a tool has to pause in the meantime, share your files with VAULO.
VAULO is GDPR-compliant and you can try it free for 30 days. After that, you book a plan yourself in your account and pay by invoice, via Stripe or with PayPal. Would you rather have someone show you VAULO first? Then book a demo.
Start your free 30-day trial or Book a demo
For your IT team
The vulnerabilities have the identifiers CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
For PHP 8.1 and older, some distributions and LTS providers offer backports. If you build PHP yourself from source, the PHP team provides small backports for PHP 7.4, 8.0 and 8.1.
Details: BSI (in German), CERT-EU, ENISA, NCSC-NL (list of affected software)
