PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
First Published: 23 October 2026
Last Updated: 23 October 2026
Version: 1
Overview
On October 20, 2026, information regarding two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (collectively referred to as “PHP2Shell”), became publicly available. These vulnerabilities may allow unauthenticated remote code execution under certain conditions and have been assessed as critical. Security researchers and vendors have reported active exploitation attempts in the broader threat landscape.
Daikin's product security and incident response teams have reviewed the information currently available regarding these vulnerabilities and are continuing to assess any potential impact on Daikin products and cloud-based services.
Based on the information available and our assessment as of 23 October 2026, Daikin is not aware of any products or services affected by CVE-2026-109618 or CVE-2026-109619. In addition, Daikin is not aware of any exploitation affecting Daikin products or services related to these vulnerabilities.
Daikin continues to monitor developments closely and will review any new information as it becomes available. Should our assessment change, relevant updates will be published on this page.
At this time, no specific actions are required from customers based on Daikin's current assessment.