BORIS for Autodesk Inventor - Secure Your CAD Designs

php2shell PHP Vulnerabilities: Autodesk Says Inventor Is Not Impacted, but the Web Systems Around Your Designs May Be | Autodesk Inventor | Register and Certify Ownership of CAD design

2026-10-26 15:46 News
On 21 October 2026 the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, now known as php2shell. Both can let an attacker run code on a web server without logging in. The same day Autodesk published a security bulletin: Autodesk Fusion has been fixed, and Autodesk lists its desktop products as not impacted. Inventor itself is safe from this bug, but many of the web systems that store, share and sell Inventor designs are not.
PHP is the programming language behind a large share of the web: company websites, customer portals, file-sharing servers, ticket systems, web shops and many small admin tools. Palo Alto Networks' Unit 42 counted more than 22.6 million exposed instances that are potentially vulnerable. The response was unusually drastic. Several governments, including Germany, France, Belgium, Finland and the Netherlands, took public websites offline as a precaution while they patched, and a UK minister told the House of Lords that 32 government services were unavailable.
For an engineering company that designs in Autodesk Inventor, the CAD workstation is not where this risk sits. It sits in the systems around it: the website with a download area for drawings, the self-hosted file-sharing server used with suppliers, the support portal where customers upload STEP files, the shop that sells spare parts.
TL;DR: Inventor is not affected, but the web systems around your designs may be

Two critical PHP flaws (CVSS 9.2 each) allow unauthenticated remote code execution on web servers. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. Autodesk says Fusion is fixed, Autodesk PIX is mitigated with a permanent fix in progress, and all other Autodesk products, including Autodesk Account and its desktop products, are not impacted. Amazon saw a first exploitation attempt on 17 October, four days before disclosure. Find every PHP system that touches your CAD data, patch or take it offline, and check logs back to 17 October.

What is php2shell and why is it so serious?

php2shell is the name researchers gave to two memory flaws in the core of PHP. According to CERT-EU, the first, CVE-2026-109618, is triggered when PHP aborts a request that runs out of memory, for example while parsing a form-based file upload, and leaves internal data half initialised. The second, CVE-2026-109619, lets state from one request survive after its memory has been freed, so a later request on the same worker can use it. Both are rated 9.2 out of 10 under CVSS 4.0.
Three things make this worse than a typical web bug. First, it sits in PHP itself, not in one application, so every PHP installation that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Second, the PHP team considers the mod_php setup the highest risk, and a demonstrated exploit triggers the attack with a single unauthenticated request before any application code runs, so a login page does not protect you. Third, it is old. Tenable reports that the earliest affected code path goes back to PHP 5.4.0, so forgotten servers that nobody has updated for years are exposed too.
Researchers at Calif and Wiz, who were credited by the PHP Foundation together with OpenAI and others, said they used AI models in their research. Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla, and a memory disclosure path that could expose passwords, tokens, API keys and certificates.

What did Autodesk say about Inventor, Vault and Fusion?

Autodesk published its security bulletin on the PHP vulnerabilities on 21 October and updated it on 23 October. It says Autodesk added web application firewall rules and code configuration changes, and is deploying permanent fixes where applicable. It also says it has found no evidence that Autodesk products or services have been successfully exploited or compromised.
As of 23 October, Autodesk's assessment was: Autodesk Fusion is fixed; Autodesk PIX is mitigated with a permanent fix in progress; and all other Autodesk products are not impacted, including Autodesk Account and Autodesk desktop products, with AutoCAD and Revit given as examples. Inventor and Vault are not named one by one, but both are Autodesk desktop products and fall under that statement. Autodesk adds that the list may be updated, so check the bulletin again before you close the topic.
That is reassuring for Inventor users, but it only covers software Autodesk makes. Your Vault server runs on Windows with Microsoft software, and your Inventor add-ins come from many vendors. As we described in our article on the Siemens Software Center ClickFix attacks, tools installed next to CAD software can create risks that the CAD vendor cannot fix for you.

How quickly did attackers move?

The disclosure did not go to plan. According to Huntress, a post on Hacker News on the morning of 20 October revealed the vulnerabilities before the embargo ended, and the PHP security team moved its release forward by a day to 21 October. Amazon Threat Intelligence reported that its honeypot network had already recorded an exploitation attempt dating to 17 October, four days before disclosure, and that it does not know how the attacker got the information.
On 21 October Amazon's chief information security officer, CJ Moses, wrote: "PHP2Shell is now seeing broad exploitation attempts in the wild." Amazon added that it was unclear whether those attempts would have succeeded against real systems. heise reported that Cloudflare saw millions of exploit attempts, starting about ten hours before public disclosure. The US agency CISA said in its alert on the PHP vulnerabilities that it had not observed successful exploitation at publication, and it urged organisations to patch immediately.
On 23 October PHP disclosed a third remote code execution flaw, CVE-2026-115560, which CERT-EU says affects only unusually configured web applications. Full details will follow with the next PHP release.

Where could PHP be hiding around your Inventor data?

Most CAD managers do not think of PHP as part of their stack. But PHP is often installed as part of something else, which is why CISA asks organisations to look for PHP bundled inside other software, and Huntress mentions Windows software that ships its own php-cgi.exe. Here is where it typically appears in a manufacturing company that works with Inventor:
SystemTypical examplesWhat it can exposeWhat to check
Company websiteWordPress, Drupal or Joomla site with a download area for drawings, datasheets or CAD modelsFiles offered to customers, form uploads, admin passwordsPHP version at the hosting provider, plug-ins, who can log in
File sharing with suppliersSelf-hosted file-sharing or cloud-drive software running on PHPComplete project folders, STEP and native Inventor files, share linksWhether it is reachable from the internet, version, access logs since 17 October
Customer and support portalsTicket systems or portals where customers upload models and drawingsCustomer CAD files, RFQs, contact dataPHP version, upload limits, whether the vendor has issued an update
Web shop for spare partsMagento or other PHP shop softwareProduct data, customer accounts, payment flowsPatch status at the shop provider, admin accounts
Internal admin toolsDatabase admin pages, intranets, small tools set up years agoDatabase contents, credentialsForgotten servers, old PHP branches such as 7.x or 8.1
Hosting control panelsPanels that manage the company's web serversAll sites on the serverVendor bulletin and update status
None of these systems run Inventor, but all of them can hold copies of Inventor designs. Our guides on securing CAD data in cloud storage and CAD file sharing with external collaborators explain why every extra copy outside Vault needs the same care as the original. This year's Clop PLM data leak showed what happens when a web-facing system that stores engineering files is breached: drawings from well-known companies ended up on a leak site.
Keep proof of what you designed, wherever the files travel.

BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and a certificate of ownership, directly inside Inventor, so you can show what you created and when, even if a copy leaks from a web server you do not control.

👉 Discover BORIS for Autodesk Inventor

Why does a web server bug matter for design ownership?

Remote code execution means an attacker can run their own commands with the rights of the web server. On a file-sharing server, that can mean reading every folder the server can reach. Wiz showed that the flaw can also disclose memory, which can contain passwords and API tokens. Those can open other systems, such as cloud storage or a Microsoft 365 tenant, long after the PHP server has been patched.
This is the same pattern we covered in our article on backup tools as an attack path: attackers go after the systems that hold copies of engineering data, because those are often less protected than the main CAD environment. Our guide to digital vaults and their limits for CAD storage explains why a well-managed Vault does not help if the same files sit on a forgotten web server, and our overview of the costs of CAD data breaches shows what such incidents can cost a company.

What should Inventor CAD managers do this week?

A practical checklist, based on the advice of CISA, CERT-EU, Amazon and Huntress:
  1. Make a list of every PHP system. Include the website, file-sharing servers, portals, shops, intranets, test servers and software that bundles PHP. Ask your hosting provider and agencies in writing which PHP versions they run.
  2. Patch to a fixed version. Use PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distribution's patched package, and restart all PHP workers afterwards. Start with systems that are reachable from the internet.
  3. Take unpatchable systems offline. CISA advises taking systems on PHP 8.1 or earlier offline until they are updated. Old branches get no official releases.
  4. Apply the temporary mitigations if you must wait. CERT-EU lists setting session.upload_progress.enabled to 0 and tighter memory and upload limits. These reduce risk but do not make a system safe.
  5. Check logs back to 17 October. Amazon recommends starting investigations from that date. Look for PHP processes that start shells or download tools, and for new files in web folders.
  6. Rotate secrets on exposed servers. If a server was vulnerable and reachable, change the passwords, API keys and tokens it stored, including links to cloud storage.
  7. Remove CAD files from web servers that do not need them. Old download folders and expired supplier shares should go. Our guide on how to share CAD files securely compares safer options.
  8. Keep dated proof of your key designs. Register important Inventor versions with a timestamp, so ownership never depends on the records of a system that may have been breached.
Do not forget the workstations and servers on your own side of the network. This month also brought the .NET 10 transition for Inventor and Vault and the end of Windows 10 ESU Year 1. Patch planning for CAD environments now has to cover the operating system, the runtime, the CAD software and the web systems around it.

The bigger picture

This week's news on our sister sites is about what happens to design data once it leaves the original system:
CADChain explains how its CAD data protection technology works across CAD systems, and our article on blockchain timestamps for proving design authorship shows how dated records work in practice. For another recent example of design data leaving a company through a third-party service, read our analysis of AI quoting agents and RFQ drawings. For backups that survive an incident, see CAD file backup strategies for engineering firms.

Conclusion

php2shell is not an Autodesk problem: Autodesk fixed Fusion quickly and says Inventor and its other desktop products are not impacted. It is a reminder that Inventor designs live in many more places than Inventor and Vault. Websites, portals, file-sharing servers and shops keep copies of drawings and models, and many of them run on PHP. Find those systems, patch them or take them offline, check them for traces back to 17 October, and remove design files that do not need to be there. And keep your own dated proof of what you designed, so your ownership does not depend on how well a web server was maintained.
Your designs, your proof.

BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, without sending your models to a cloud service.

👉 See how BORIS for Autodesk Inventor works

FAQ: php2shell and Autodesk Inventor

What is php2shell?

php2shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. Both are rated 9.2 under CVSS 4.0 and can allow an attacker to run code on a web server without logging in.

Is Autodesk Inventor affected by php2shell?

No. Autodesk's security bulletin, last updated on 23 October 2026, lists all Autodesk products other than Fusion and PIX as not impacted, including Autodesk Account and its desktop products. Inventor and Vault are desktop products, though they are not named individually.

Was Autodesk Fusion affected?

Autodesk lists Fusion as fixed. It says it has found no evidence that Autodesk products or services were successfully exploited or compromised.

Which PHP versions fix the flaws?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older no longer receive official releases; the PHP team published minimal source backports for 7.4, 8.0 and 8.1 for organisations that build PHP themselves.

Is php2shell being exploited?

Amazon reported an exploitation attempt dating to 17 October 2026 and broad exploitation attempts after disclosure, but said it was unclear whether they succeeded. CISA said it had not observed successful exploitation when it published its alert on 21 October.

How can a PHP bug put my Inventor designs at risk?

Inventor files are often copied to websites, file-sharing servers, customer portals and web shops, many of which run on PHP. An attacker who gains code execution on such a server can read the files it stores and the passwords or tokens it holds.

What should I do if I cannot patch a system quickly?

CISA advises taking it offline until it is updated. CERT-EU lists temporary mitigations, such as setting session.upload_progress.enabled to 0 and tightening memory and upload limits, but stresses that these do not make a system safe.

How does BORIS help after a security incident?

BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor. Each registered version gets a dated certificate of ownership, so you can show what you designed and when, even if copies leak from a third-party or web system.