Security notices Whether published vulnerabilities affect Analyse-it, analyse-it.com and the services we use.

Summary

When a widely reported vulnerability raises questions from IT and quality teams, we record our assessment here with the date we made it, so you can reference it in your supplier records. If a vulnerability you need an answer on is not listed, contact support@analyse-it.com.

Current notices

PHP2Shell: CVE-2026-109618 and CVE-2026-109619

· Not affected

On 21 October 2026 the PHP project released fixes for two critical vulnerabilities in the PHP interpreter that allow unauthenticated remote code execution on web servers running PHP. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Analyse-it is not affected:

  • The Analyse-it software is written in C#, with numerical libraries in C++ and FORTRAN, and runs inside Microsoft Excel on your computer. It contains no PHP and does not run a web server.
  • Our servers run ASP.NET on Microsoft Windows and IIS, and PHP is turned off on all of them. That covers https://analyse-it.com, including the store and downloads, and the licence servers that activate Analyse-it.
  • Third-party services on our website, such as payment processing and the support chat, run on their providers’ own infrastructure, and those providers are responsible for patching it.

You do not need to update Analyse-it or change anything on your computers in response to these vulnerabilities.

Security of the software

  • Your data stays on your computer. All statistical computation happens locally inside Microsoft Excel. The only network communication Analyse-it performs is licence activation, update checks and, if enabled, automated exception reporting. None of these include your analysis data.
  • Signed installers. Analyse-it is distributed as an MSI installer signed with our code-signing certificate, so you can confirm it came from us and has not been altered.
  • Version control. Every release has a unique version number and is listed in the release history, so you can apply updates under your own change control.

For how Analyse-it is developed and tested, see how we develop and validate Analyse-it.

Reporting a security concern

If you find a security problem in Analyse-it or analyse-it.com, contact support@analyse-it.com. Your message goes to the people who build Analyse-it.

Frequently asked questions

Do I need to update Analyse-it because of PHP2Shell?

No. Analyse-it contains no PHP, so there is nothing to update.

Our IT team needs a statement for our supplier records. Can you provide one?

Yes. You can reference this page, which is dated and kept as a permanent record. If your organisation needs a statement in another form, contact us.