Technical Bulletin
To: DW® Customers
Date: October 26, 2026
Re: CVE-2026-109618 and CVE-2026-109619 PHP Vulnerability Statement
CVE-2026-109618 and CVE-2026-109619 PHP Vulnerability Statement
-----------------------------------
DW Products: DW Spectrum Professional & Enterprise (Media Server and Client), DW Spectrum Mobile Client, DW Spectrum Web Client, DW Cloud
Release Date: October 26, 2026
-----------------------------------
CVE-2026-109618 and CVE-2026-109619 Vulnerability Statement
This technical bulletin is being issued to address the recently disclosed "CVE-2026-109618" and "CVE-2026-109619" PHP vulnerability and to provide clarity on the potential impact to Digital Watchdog products.
On October 21, 2026, a critical flaw in the PHP core was publicly disclosed, assigned the IDs CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities allow an unauthenticated attacker to run code remotely on a web server using PHP with a single request. A working exploit has been publicly disclosed and attacks are ongoing. Servers running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed are included in those affected.
The PHP team has fixed these issues in the following versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
DW Spectrum does not use PHP and is not affected by either of these issues. However, if other third-party applications or servers on your network run PHP, update them to a fixed version or check the Linux distribution or software vendor for an updated package.
Recommended Actions
Although DW Spectrum is not affected, many websites and web applications do run on PHP. If one of these applications has been compromised, the passwords and other information may have been stolen. If you have used the same password for a Digital Watchdog account and any other application or website, an attacker could use it to sign in to your DW Spectrum site or DW Cloud account if 2FA is not enabled.
Digital Watchdog advises changing any passwords that have been used across multiple websites or applications, including local DW Spectrum site users and DW Cloud accounts.
- Resetting a DW Cloud Password
- Password Recovery - DW Blackjack/Spectrum
- Enabling Two-Factor Authentication (2FA) for DW Cloud
Additional Information
Digital Watchdog takes the security of our customers' systems seriously and will continue to monitor this situation closely. Updated guidance and any relevant firmware or software updates will be communicated as they become available. For more information on the underlying vulnerability, refer to the following:
______________________________________________________________________________
For More Information or Technical Support
DW Technical Support: https://www.digital-watchdog.com/contact-tech-support/
DW Sales: sales@digital-watchdog.com | www.digital-watchdog.com
Rev: 06/25 Copyright © DW. All rights reserved. Specifications and pricing subject to change without notice.