The recent PHP vulnerabilities have raised questions about the security and availability of invoice processing software. The impact differs by product and version for users of Tungsten, Coupa, ISPnext and Routty.
Two critical PHP vulnerabilities prompted security updates released on 21 October 2026. These vulnerabilities could allow attackers to execute code on vulnerable servers without login credentials. An affected installation does not automatically mean a system has been compromised.
Tungsten Process Director Web Application
All versions of the Tungsten Process Director Web Application are unaffected by these PHP vulnerabilities. No patches or additional measures are required for this specific application in relation to these vulnerabilities.
Tungsten AP Essentials
Tungsten AP Essentials (APS) is unaffected by these PHP vulnerabilities. Users do not need to take action within the service in response to this issue.
Coupa
Coupa is currently understood to be unaffected, although this assessment is awaiting validation. Confirmation is needed before we can consider its status final.
Routty IDP and Routty Cloud
Routty IDP and Routty Cloud are unaffected by these PHP vulnerabilities.
Routty AP and AR
Routty AP and AR versions 22.03 and newer are affected, and patches have been applied to address the vulnerabilities.
Versions older than 22.03 are also affected and have been patched, but additional measures are required. Customers using these versions should contact their support partner to confirm the actions needed for their environment.
Routty Capture
Routty Capture is unaffected by these PHP vulnerabilities.
ISPnext
ISPnext is unaffected by these PHP vulnerabilities. Customers do not need to apply patches or take additional measures for this issue.
What should users check?
Alongside the product status, organisations should review any customer-managed integrations or additional applications that use PHP. An unaffected application may still depend on a separate component that requires attention.
Where processing has been interrupted, check pending invoices and document delivery statuses before resubmitting anything. This helps prevent missed documents or duplicate processing when services resume.
Questions about your environment or the additional measures required for older Routty AP and AR versions? Contact Dynatos to discuss the next steps.
