No. None of our software uses PHP.
SyncBackPro, SyncBackSE, SyncBackFree, SyncBack Management System (SBMS), SyncBack Touch, SyncBack Monitor and the OnClick Utilities are all written in Delphi and compiled into native programs. They do not include, install or need PHP, so the recent PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) do not affect them. You do not need to update or change anything in SyncBack because of them.
Scripts and programs run by profiles
SyncBackPro scripts are written in Pascal, Basic, VBScript or JScript, not PHP. The only way SyncBack would ever run PHP is if you installed PHP yourself and set a profile to run a PHP program before or after it runs. In that case it is your own copy of PHP that would need updating.
Our websites
Parts of www.2brightsparks.com, our community forum and our mailing list do run on PHP, and SyncBack connects to our website when it checks for a new version. We put a temporary fix in place on all of our servers on 21st October 2026, and all of them were running patched versions of PHP by 22nd October 2026. We also checked every server for signs of an attack and found none.
We never receive credit card details. Card payments are handled entirely by our payment provider, FastSpring.
If you have any other questions, please contact our support team.