Regarding CVE-2026-109618 and CVE-2026-109619
In response to the recently disclosed critical vulnerabilities in PHP, referred to as PHP2Shell, and the corresponding security advisory published by the German Federal Office for Information Security (BSI), TE-SYSTEMS would like to clarify the impact on its products anynode and XCAPI.
Neither anynode nor XCAPI is affected by these vulnerabilities.
Both products operate independently of PHP and do not use PHP as part of their software architecture.
As a result, the reported PHP vulnerabilities do not affect anynode or XCAPI, and no product-specific security updates or configuration changes are required to address these vulnerabilities.
This assessment applies to the TE-SYSTEMS products themselves. Customers should independently assess any additional PHP-based applications or services within their IT environments.
TE-SYSTEMS remains committed to product security and continues to monitor relevant security developments.
Reference: BSI Security Advisory BITS-H 2026-297981-1032