Security Advisory
Cybersecurity
As IoT adoption continues to proliferate, cybersecurity has become one of the top priorities. Aten created a vulnerability management policy to provide guidance and information to our customers in the event of a reported vulnerability. The management policy ensures that Aten's customers have steady, unambiguous resources to help them understand how Aten resolves or mitigates reported vulnerabilities.
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Release Date: 2026/10/27
Vulnerability Scoring Details :
The vulnerability scores and vectors are listed below.
| Severity | CVSS Score | Vector |
|---|---|---|
| HIGH | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
We have conducted a security assessment of CVE-2026-109618 and CVE-2026-109619 to evaluate their potential impact on our products.
The assessment covers all currently supported versions of our products.
Based on our current assessment, we have not identified any use of the affected PHP components in our products. Therefore, no impact on our products has been identified, and no product-specific remediation is currently required.
Customers who use PHP in their own environments are advised to review their PHP installations and refer to the relevant official security advisories to determine whether additional actions are necessary.
We will continue to monitor these vulnerabilities and update this advisory if new information or changes to our assessment become available.
For further information or security-related inquiries, please contact our Technical Support Team.
