PROGNOST confirms that its products do not use or depend on PHP as part of their application software or runtime environment. Therefore, the recently disclosed critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 do not affect PROGNOST products.
These vulnerabilities specifically affect PHP installations serving web requests and can allow unauthenticated remote code execution.
Based on the technology used within our products, no customer action or product update is required from PROGNOST in response to these PHP vulnerabilities.
As part of our IEC 62443-4-1 compliant secure development lifecycle (SDLC), PROGNOST continuously monitors relevant security vulnerabilities and assesses their potential impact on our products.
