PHP vulnerabilities:
IDY products are not affected
We have confirmed that IDY products are not affected by the two recently disclosed PHP vulnerabilities. No firmware updates or configuration changes are required for IDY products in response to these vulnerabilities.
Thank you for your continued support of IDY products.
On October 21, 2026, The PHP Group published advisories for two vulnerabilities that could allow arbitrary code execution in PHP (CVE-2026-109618 and CVE-2026-109619). The impact on IDY products is described below.
Impact on IDY products
Our engineering team has verified that all products sold by IDY are not affected by these vulnerabilities.
IDY product firmware does not include PHP, and none of the product functions, including the web-based configuration interface (WebUI), use PHP.
Action required
No action is required for IDY products in response to these vulnerabilities, including firmware updates or configuration changes.
Vulnerabilities covered
For details, please refer to the advisory published by JVN (Japan Vulnerability Notes).
- CVE-2026-109618: RCE via OOM corruption — A vulnerability in out-of-memory handling that could allow arbitrary code execution.
- CVE-2026-109619: RCE via stale global state — A vulnerability involving internal state retained between requests that could allow arbitrary code execution.
Systems used with IDY products
The confirmation above applies to IDY products.
If PHP is used on customer servers or other systems connected to or used with IDY products, please review the latest information from the respective providers and take the necessary action.