May 2026
Latest security updates
Over the past few months, there has been a significant increase across the industry in the number of reported vulnerabilities in widely used third-party components such as PHP, OpenSSL and similar frameworks. This trend is further exacerbated by the fact that, thanks to the use of modern AI-powered analysis tools, far more potential vulnerabilities are now being automatically identified and published than was the case just a few years ago. We are monitoring this very closely and are currently working on a process document that sets out our approach to security-related updates for third-party components in a structured and transparent manner. We will make this available as soon as it has been finalised.
Vulnerability: CVE-2026-28387
Against this background, we would like to inform you of another security vulnerability in OpenSSL, published at CVE-2026-28387. This is a use-after-free vulnerability in DANE-TLSA-based server authentication, which can lead to memory corruption or application crashes under certain conditions.
Measures for existing customers
For Windows environments, we provide an updated version of the OpenSSL HotfixPatcher as well as alternative update packages. Please note that we only support PHP versions from PHP 8.2 onwards. If you are using older PHP versions that have already reached end-of-life, please open a support ticket via the SIS.one Service Desk or contact your Quanos partner.
Which files need to be updated depends on the actual OpenSSL library version in use – this is not directly linked to the PHP version and is also independent of the ExportDynamic version used. We therefore recommend using the OpenSSL HotfixPatcher:
- The tool identifies the version of the OpenSSL library in use in a specified path
- It then offers to update the relevant files
- A backup of the existing files is created automatically during this process
- Once complete, a message appears indicating whether the update was successful
Alternatively, the tool can also be used solely to determine the version of OpenSSL currently in use.
Instructions are included with the package as a PDF file.
Customers who wish to perform the update manually can use the update package provided. This can be used for both server publications and offline publications and contains updates for all affected OpenSSL library versions. Instructions are included in the file HowTo.txt.
Quanos does not provide PHP/Apache for Linux environments. OpenSSL is managed at the system level in these environments; please ensure that your system administrator installs the relevant update.
You can download the packages mentioned above here:
If you are unsure which version you are using or require assistance with the upgrade, please open a support ticket via the SIS.one Service Desk or contact your Quanos partner.
March 2026
Urgent Security Update of the OpenSSL Libraries in the PHP Frameworks
Due to current circumstances, we would like to inform you about a security vulnerability related to OpenSSL. Our developers have classified this security vulnerability CVE-2025-15467 as critical. The PHP versions we support use an affected OpenSSL version.
Our installations from PHP 8.2 and higher are affected. Older versions may also be affected, but are no longer delivered or supported by us.
Under certain circumstances, the security vulnerability can compromise the integrity and security of the application. For this reason, we are providing both an automated update tool—OpenSSL HotfixPatcher —as well as alternative update packages for Windows environments, with which the affected OpenSSL files can be replaced.
Please note:
Which files need to be updated depends on the actually used OpenSSL library version. This is not directly tied to the PHP version and is also independent of the ExportDynamic version in use
Measures for Existing Customers
To ensure that the update is performed with the correct OpenSSL library version, we recommend using our OpenSSL HotfixPatcher tool:
- The tool determines the used OpenSSL library version in a specified path
- It then offers to update the affected files
- A backup of the existing files is automatically created
- After completion, it displays whether the update was successful
Alternatively, the tool can also be used exclusively to determine the currently deployed OpenSSL version. Instructions are included in the package in the form of a PDF file.
Customers who wish to perform the replacement manually can use the provided update package. This package can be used for both Server publications and Offline publications and contains updates for all five affected OpenSSL library versions. Instructions are included in the package in the form of a HowTo.txt.
For Linux environments, Quanos does not deliver PHP/Apache. There, OpenSSL is managed at the system level. Please ensure that in this case your system administrator performs a corresponding update.
We strongly recommend implementing the mentioned measures promptly to continue ensuring secure operation.
Here you can download the packages mentioned above:
If you are unsure which version is in use at your location or need support with the replacement, please open a support ticket via the SIS.one Service Desk or contact your supporting Quanos partner.
October 2024
Updated in July 2025
CATALOGcreator: Important notice due to PHP security vulnerability
Due to recent events, we would like to point out a security vulnerability in PHP, which is classified as critical by our developers.
All installations of ExportDynamic that are installed on web servers (IIS or Apache) are affected.
From ExportDynamic 3.15
PHP has made new security releases available for the current PHP versions that fix this security vulnerability. We have adapted the PHP packages for our software and make them available to you via download on our website, see buttons. Depending on the ExportDynamic version you are using, the PHP packages specified must be replaced:
- from ExportDynamic 3.17 => Download PHP 8.3.23
- ExportDynamic 3.16/3.16.1 => Download PHP 8.2.29
- ExportDynamic 3.15 => Download PHP 8.1.30
ExportDynamic versions 3.14 and older are NOT compatible with the PHP versions mentioned above and cannot be used there!
The ExportDynamic version used is displayed in the online catalog via the "About" link in the footer.
Update Instructions for Webserver with IIS:
- Copy the previous php.ini into a temp directory for a later file comparison
- Create a backup of the existing PHP folder, e.g. export the folder to a ZIP archive and move it to a backup directory with a unique name
- Stop the website and the application pool in IIS
- Empty the existing PHP folder
- Unzip the new PHP package and paste it into the same folder
- Optional (only if a different directory is now used for PHP): Enter the new php-cgi.exe for FastCGI in the IIS under "Handler Mapping" for *.php
- Use WinMerge to compare the new php.ini with the previous one (which was previously stored in a temp directory)
- check the parameters and enter all customer-specific settings to the new php.ini (e.g. extension=ldap, activate https per session.cookie_secure = 1, max_execution_time, etc.). )
- Enter the paths to the \tmp directory, to the extensions and to CACERT (all are usually at the end of the php.ini supplied by Quanos). These path entries are prepared for the default folder D:\CATALOGcreator.
- Alternatively, the php.ini can also be checked and adapted manually with Notepad++.
- Restart the website and AppPool in IIS
- Use a test.php in the public folder with the content
- <?php phpinfo();?> to check whether the new PHP version and the correct php.ini are being used. This test file must be deleted immediately afterwards!
- In case of problems, check the PHP folder for the necessary read permissions of the IIS_IUSRS group
Procedure for ExportDynamic 3.14 and older
Older PHP versions, i.e. PHP 8.0 and older, are classified as End of Life by the manufacturer and therefore no longer receive updates!
This means that no PHP packages are available for ExportDynamic version 3.14 and older. In this case, the entire installation of the Quanos products must be updated in the form of a project update and thus upgraded to a current ExportDynamic. This is a chargeable service. In this case please open a support ticket via the Quanos Service Desk or contact your Quanos Partner.
We support you
If you are unsure which version you are using or need assistance with a replacement, please open a support ticket via the Quanos Service Desk or contact your Quanos partner.