On October 21, 2026, two critical PHP vulnerabilities were disclosed: 

  • CVE-2026-109618
  • CVE-2026-109619

Under certain conditions, these vulnerabilities may allow remote code execution.

Neither atvise® nor the atvise® bundles OT1200 and OT1300 use PHP. Therefore, these products are not affected by the mentioned PHP vulnerabilities.

No impact or further action is required for atvise®, OT1200, or OT1300 in relation to these PHP CVEs.