PHP2Shell Vulnerabilities

Giga Computing Technology Co., Ltd. is aware of the recently disclosed PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, with a CVSS v4.0 score of 9.2. These vulnerabilities affect the PHP engine and could allow an unauthenticated remote attacker to execute arbitrary code on web servers running vulnerable PHP versions.

After a thorough review, Giga Computing confirms that PHP is not used in any of its products, including BIOS, BMC firmware, and related management tools and utilities. Therefore, Giga Computing products are not affected by these vulnerabilities, and no firmware update or customer action is required.

Customers running PHP-based applications in their own environments are advised to follow the official PHP security advisory and update to a fixed release (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later).

Giga Computing will continue to monitor this issue and will provide updates should any new information become available.

*For any further assistance regarding this issue please contact your Giga Computing sales representative, or create a new support ticket at https://esupport.gigabyte.com