On October 21, 2026, the NSA issued an advisory on critical vulnerabilities in PHP, a scripting language widely used on web servers. The flaws, known as “PHP2Shell,” could allow an attacker to take control of an affected server without authentication. The NSA expects attackers to exploit them and has called for immediate patching.
Sigma uses PHP. All current REDCOM products are built on Sigma, including Sigma XRI and Sigma SVG, and are affected. There may be configuration changes you can make in Sigma to limit PHP vulnerabilities, but not all issues can be mitigated this way.
REDCOM strongly recommends that all customers upgrade to a patched release. Sigma 4.4.3 will be available on November 5, and Sigma 4.2.7 on November 10. Plan your upgrade now so you’re ready when the patch is released.
To request a software patch or for assistance with a Sigma upgrade, please reach out to support@redcom.com
REDCOM Maintenance & Support
A REDCOM Sigma Support Plan is the best way to stay current on Sigma software, as the plan includes unlimited upgrades, patch releases, and 24×7 remote call-in support from our US customer support team. If you are not on a maintenance plan, aren’t sure which release fits your deployment, or have questions about this issue, please contact a REDCOM solution advisor for guidance on an upgrade path.
