M5 statement on Vulnerability Affecting PHP - CVE-2026-109618-CVE-2026-109619
On October 21, 2026, information was published about CVE-2026-109618 and CVE-2026-109619, commonly referred to as “PHP2Shell”. They are memory safety vulnerabilities in PHP that can lead to remote code execution (RCE) and are rated critical.
M5 Technologies has reviewed the published information and assessed the potential impact on Mediatrix and Sentinel products.
Impact for Mediatrix customers
The Mediatrix 4102, C7, G7 and S7 series do not use PHP to process web requests. These products cannot be exploited through CVE-2026-109618 or CVE-2026-109619.
Impact for Sentinel CS customers
The Sentinel 100, Sentinel 400 and Sentinel CS use PHP only for parts of the web management interface. On these products, PHP processing can only be reached after successful authentication through the web interface. As a result, these products cannot be exploited through CVE-2026-109618 or CVE-2026-109619 by an unauthenticated attacker.
Recommendations
M5 Technologies recommends changing default administrator passwords, using strong passwords, and restricting access to the management interface to trusted networks.
M5 Technologies continues to monitor these vulnerabilities and will update this statement if new information becomes available.
This document contains information that is proprietary to M5 Technologies.
M5 Technologies reserves all rights to this document as well as to the Intellectual Property of the document and the technology and know-how that it includes and represents.
This publication cannot be reproduced, neither in whole nor in part, in any form whatsoever, without written prior approval by M5 Technologies.
M5 Technologies reserves the right to revise this publication and make changes at any time and without the obligation to notify any person and/or entity of such revisions and/or changes.