When security experts around the world disclose critical vulnerabilities, customers naturally ask the question: "Does this affect us?"
On October 21, 2026, the PHP Project published details of two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both affect the PHP runtime and, under certain conditions, could allow unauthenticated remote code execution.
Whenever a significant vulnerability is announced, LRS assesses its relevance to our supported products and services. After reviewing these two vulnerabilities, we can confirm that neither CVE-2026-109618 nor CVE-2026-109619 affects any currently supported LRS Enterprise Output Management product or service.
CLICK HERE FOR PHP VULNERABILTY NON-IMPACT ATTESTATION
Our assessment covered supported LRS EOM software products, appliances and associated components, including bundled and third-party elements supplied with our solutions. We also reviewed LRS-managed and hosted services.
We found no applicable vulnerable PHP implementation or exploitable exposure within the supported LRS EOM portfolio.
What does this mean for LRS customers?
The answer is straightforward: customers using supported LRS Enterprise Output Management products or services do not need to take any action in response to these vulnerabilities.
Our customers rely on LRS solutions to manage print and document output across enterprise environments. Output may originate from user devices, ERP and EHR platforms, core business applications, cloud services or mainframe systems before being delivered to printers, archives, digital channels and other destinations.
When a new security issue is disclosed, customers need to know whether the technology supporting these processes is exposed. Equally, when it is not, they need a timely and unambiguous answer. That is why we continually evaluate relevant security disclosures through our vulnerability management and secure development processes. Our objective is not simply to track vulnerabilities, but to understand whether they apply to our products, components, services and supported architectures.
Read the official LRS security notice
We have documented the scope, technical basis and conclusion of our assessment in a formal customer notice, which can be found here. The notice confirms that no product-specific patch, hotfix, PHP upgrade, configuration change, workaround or service restart is required for supported LRS EOM environments in response to these CVEs.
Ongoing security assurance
We will continue to monitor relevant security disclosures and assess any new information that could affect our products or services.
If new information materially changes our assessment, we will issue updated guidance through our established customer support channels. Based on the information currently available, we do not expect LRS customers to need to take any further action.
For product documentation, technical information or assistance, customers can visit the LRS Support Site or contact their usual LRS support representative.
For more information about the vulnerabilities themselves, review the PHP Project’s official security release information.
The bottom line
Supported LRS Enterprise Output Management products and services are not affected by CVE-2026-109618 or CVE-2026-109619, and no customer action is required.