This article is our current position statement on recent CVE reports regarding PHP vulnerabilities.
Applies to: All SNS EVO Storage Systems (EVO v7 and EVO Suite)
Risk Level: None / Not Applicable
Overview
In October 2026, security advisories were disclosed regarding critical remote code execution vulnerabilities in PHP core ( CVE-2026-109618 and CVE-2026-109619). These vulnerabilities involve memory corruption during out-of-memory handling and stale global state reuse in environments running PHP.
EVO version 7 and the EVO Suite software do not utilize PHP by default in their core environment or standard deployment stack.
Vulnerability Assessment
CVE-2026-109618 & CVE-2026-109619 (PHP Remote Code Execution): NOT AFFECTED.
The vulnerabilities specifically require an active PHP interpreter stack to process incoming web requests or system operations.
EVO version 7 and the EVO Suite are PHP-free by default and do not ship or rely on PHP binaries, web worker modules, or CGI handlers within the default operating environment.
Because PHP is absent from the standard system boundary, neither vulnerability can be triggered or exploited on an EVO system.
Customer Action
No action is required. Because PHP is not utilized in standard EVO v7 and EVO Suite deployments, systems remain secure against these exploits. No software updates or patch installations are necessary for these CVEs.