Impact of Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Our Products
On October 21, 2026, two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed. The following provides an overview of the vulnerabilities and the recommended countermeasures.
Summary
- CVE-2026-109618: Remote Code Execution Caused by Memory Corruption During an Out-of-Memory Condition.
- CVE-2026-109619: Remote Code Execution Caused by Residual Internal State.
If these vulnerabilities are exploited, an unauthenticated remote attacker may be able to execute arbitrary code on an affected system. This could affect the confidentiality, integrity, and availability of data and services, including unauthorized access to information, modification of system data, installation of malicious software, and service disruption.
Impact on our products
Our investigation into the impact on our products confirmed that myQ, aQrate and Fiery are affected.
Affected products
- myQ: Version 10.2 (Patch 26) and earlier
- aQrate: 8.2 (Patch 61) and earlier
- Fiery: Current market version
Countermeasures
No permanent workaround is available. The security patch must be applied.
Until the fixed version is applied, prevent direct access from the internet and restrict access to only the required networks, users, and devices. Monitoring the server for suspicious activity may help reduce the risk.
We will provide further information as soon as the security patches are ready.
Until the fixed version is applied, prevent direct access from the internet and restrict access to only the required networks, users, and devices. Monitoring the server for suspicious activity may help reduce the risk.
We will provide further information as soon as the security patches are ready.