WTI Knows • Security Notice
WTI Devices Are Not Affected by PHP2Shell
Our devices do not run PHP. No patch is required for the PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
About the PHP Advisory
On October 21, 2026, the National Security Agency (NSA) published an advisory concerning critical PHP vulnerabilities collectively referred to as PHP2Shell. These vulnerabilities can allow unauthenticated remote code execution on web servers running affected PHP versions.
Are Our Devices Affected?
No. We do not use PHP in our devices, including their embedded HTTP/HTTPS management interfaces.
An HTTP/HTTPS management interface does not by itself indicate that a device uses PHP. Because our devices do not run PHP, CVE-2026-109618 and CVE-2026-109619 do not apply to them.
Customer action: No firmware update or configuration change is required on our devices specifically for these two PHP vulnerabilities.
References
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
- PHP security advisories and release information
Last reviewed: October 23, 2026