[Security Bulletin] Impact Analysis of PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Safe Lock TXOne Edition

Timeline

Date	Description
October 21, 2026	The PHP Group released fixes for CVE-2026-109618 and CVE-2026-109619.
October 22, 2026	TXOne Networks published Impact of PHP2Shell on TXOne Networks Products. Safe Lock TXOne Edition was assessed as Not Affected.
October 30, 2026	TXOne Networks found that the vulnerable conditions extend beyond the initially reported scope, and notified Safe Lock TXOne Edition customers to update PHP.
November 6, 2026	Safe Lock TXOne Edition status changed from Not Affected to Affected by CVE-2026-109618 (further exploitation remains only a potential risk) in its default configuration. This bulletin was published.

Note: At the initial disclosure of PHP2Shell, the default PHP version used by Safe Lock TXOne Edition was outside the publicly reported affected range. Through independent root cause analysis, TXOne Networks found that the vulnerable conditions extend beyond the initially reported scope.

Overall Information

Original Released Date: November 6, 2026
Update Date: November 6, 2026
CVE Identifier(s): CVE-2026-109618
CVSS Version 4.0
- Severity: Critical
- Score: 9.2
- Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Note: This is the base score of CVE-2026-109618. In its default configuration, further exploitation on Safe Lock TXOne Edition remains only a potential risk.

TXOne Networks recommends updating PHP as soon as possible.

Description

Based on the analysis of PHP2Shell by TXOne Networks, in the default configuration of Safe Lock TXOne Edition:

CVE-2026-109618: Affected. TXOne Networks confirmed that request memory is left in an uninitialized state after an out-of-memory (OOM) error, including in PHP versions earlier than those covered by public reports. Further exploitation on Safe Lock TXOne Edition remains only a potential risk.
CVE-2026-109619: Not affected. Safe Lock TXOne Edition does not include the features required to exploit this vulnerability.

If the PHP version or configuration has been modified from the default, the impact may differ. TXOne Networks recommends updating PHP regardless of configuration.

Affected Version(s)

Product	Affected Version(s)
Safe Lock TXOne Edition	All versions running a PHP version earlier than the fixed versions listed in the Solution section

Solution

Check the PHP version by running the following command:
```
php -v
```
Update PHP based on the version shown by following PHP security advisory.

Component Fixed Version(s)

PHP 8.5 8.5.12 or later

PHP 8.4 8.4.27 or later

PHP 8.3 8.3.36 or later

PHP 8.2 8.2.35 or later

Note: If you are using PHP 8.1 or earlier, upgrade to one of the versions listed above.
Until the update is completed, apply the following mitigations to reduce the risk of exploitation:

a. In php.ini, set:
```
memory_limit = -1
session.upload_progress.enabled = 0
```
b. Restart IIS to apply the changes.
After the PHP update, some Dashboard pages may not display correctly. Safe Lock protection functions are not affected. To resolve this display issue, upgrade to Safe Lock TXOne Edition V1.1 Hotfix - Build 8023.

Note: Upgrading Safe Lock TXOne Edition does not update PHP. PHP must be updated separately as described in step 2.

Component	Fixed Version(s)
PHP 8.5	8.5.12 or later
PHP 8.4	8.4.27 or later
PHP 8.3	8.3.36 or later
PHP 8.2	8.2.35 or later

External Reference(s)

If you encounter any problems related to this vulnerability, please contact security@txone.com