PHP -CVE-2026-109618 or CVE-2026-109619.

WinMagic

Security Advisory

CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") — SecureDoc and MagicEndpoint Not Affected

Reference: KB-SEC-2026-1023 | Published: October 26, 2026 | Status: Not Affected

Applies to: WinMagic SecureDoc (all versions), WinMagic MagicEndpoint (all versions)

Executive summary

WinMagic is aware of the publicly reported critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, referred to in security reporting as "PHP2Shell." Based on the information publicly available as of October 23, 2026, both vulnerabilities affect the PHP runtime and may allow an unauthenticated remote attacker to execute arbitrary code on systems running vulnerable versions of PHP.

WinMagic has reviewed both CVEs against SecureDoc and MagicEndpoint. Neither product uses the PHP runtime or incorporates PHP-based web request processing. Based on this assessment, all versions of SecureDoc and all versions of MagicEndpoint are not affected by CVE-2026-109618 or CVE-2026-109619, and no remediation, patch, or configuration change is required for either product in response to these CVEs.

Vulnerability details

Product assessments

SecureDoc

SecureDoc does not use PHP as part of its software. SecureDoc's web-facing and server components are built on the .NET Framework , not PHP, so the vulnerable PHP runtime and the PHP request-processing functionality associated with CVE-2026-109618 and CVE-2026-109619 are not present anywhere in SecureDoc.

Conclusion: all versions of WinMagic SecureDoc are not affected by CVE-2026-109618 or CVE-2026-109619.

MagicEndpoint

MagicEndpoint's authentication flows (device-side, IdP, and endpoint communication) do not incorporate a PHP runtime or PHP-based web request processing. As with SecureDoc, the PHP components implicated in CVE-2026-109618 and CVE-2026-109619 are not present in MagicEndpoint.

Conclusion: all versions of WinMagic MagicEndpoint are not affected by CVE-2026-109618 or CVE-2026-109619.

Remediation

No SecureDoc-specific or MagicEndpoint-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-109618 or CVE-2026-109619.

Ongoing monitoring

WinMagic continues to monitor relevant security advisories and available information concerning these vulnerabilities. Should new information materially change this assessment for either product, WinMagic will review its potential impact on SecureDoc and MagicEndpoint and update this article accordingly.