The Heinlein Group says its platforms do not use PHP in their core backend components. This removes the specific attack path posed by the current PHP vulnerabilities, but does not amount to a general security guarantee.

The critical PHP vulnerabilities known as PHP2Shell have put operators worldwide under pressure to assess their systems. Under certain conditions, the flaws can allow attackers to execute code on affected servers. The Heinlein Group says its open-source platforms OpenTalk and OpenCloud are not affected.

OpenTalk uses Rust for its backend, according to the company. OpenCloud, a file-sharing and collaboration platform, was developed in Go using a microservices architecture. It does not use a PHP interpreter. The PHP vulnerabilities therefore do not affect the products’ core backend components.

Peer Heinlein, founder and managing director of OpenTalk and OpenCloud, said the decision to use Go and Rust meant users were unaffected by the PHP flaws. He also expressed solidarity with IT teams working to secure vulnerable systems and pointed to the rapid response of the PHP community.

Avoiding PHP removes the specific attack path associated with PHP2Shell. It does not address the security of other components, configurations or integrations. Operators should therefore treat the statement as applying to these PHP vulnerabilities and continue to follow relevant security advisories.

The Heinlein Group presents OpenTalk and OpenCloud as European open-source alternatives for video conferencing, file sharing and collaboration. The incident illustrates how underlying technology choices shape a product’s attack surface, while also showing why programming language alone cannot determine the security of an entire system.