Offizielles Statement von OpenLM:
The currently supported OpenLM versions (OpenLM SLM / EasyAdmin v21 and later, including v25 and v26, and OpenLM Cloud) do not include, bundle or require PHP. The platform is built on:
- .NET 8, with the built-in Kestrel web server, for OpenLM SLM, EasyAdmin and the Identity Service
- Java (OpenJDK) for the OpenLM Broker and Applications Manager
- Self-contained .NET applications for the Workstation Agent, End-User Services and Directory Sync
- SQL Server, MySQL, MariaDB or PostgreSQL as the database
No Apache/mod_php, PHP-FPM or php-cgi component is installed or used by OpenLM.
- Impact:
OpenLM Server v26 does not include, install or run a PHP runtime. This applies to the on-premises installer and to the OpenLM-hosted EU Cloud environment. The administration interface (EasyAdmin) is a JavaScript application served by OpenLM’s .NET server. CVE-2026-109618 and CVE-2026-109619 therefore do not apply. - Patch:
Not required. - Workaround:
Not required.
However, a file-level security scan of the installation folder may flag the following items. None of them is a PHP runtime:
- proxy.php and filewriter.php (in C:\Program Files\OpenLM\OpenLM Server\bin\wwwroot): PHP source files left over from an older version of the administration interface. They are inactive. With no PHP interpreter installed they cannot run, and the OpenLM web server does not serve .php files (requests return HTTP 404). We will remove them in an upcoming release so they no longer show up in scans.
- A folder named php (in wwwroot\core-app\assets\monaco\vs\basic-languages): contains php.js, a JavaScript file the built-in code editor uses for syntax highlighting. Despite the folder name, it contains no PHP code.