PHP2Shell / CVE-2026-109618 and CVE-2026-109619

Security Advisory: PHP2Shell / CVE-2026-109618 and CVE-2026-109619

Priority: Informational

DrayTek Products Affected: None

Action Required: None

In Oct 2026, PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 updates to fix to two critical vulnerabilities. We're publishing this information in response to customer enquiries asking about DrayTek products.

We can confirm that PHP is not used by any current DrayTek Router, Access Point, or Switch product. DrayTek products mostly use DrayOS (our proprietary closed OS) or a hybrid OS and none of our models use PHP.

We can also confirm that VigorACS does not utilise PHP as part of its application architecture. VigorACS is not dependent upon a PHP runtime and therefore is not affected by vulnerabilities which specifically target PHP installations or web applications which are PHP enabled.

Any updates or changes in the situation will be posted here.