23 October 2026 – PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities in PHP. The Edge Portal web interface on SIA Connect gateways runs on PHP and is therefore affected. This is an advisory about a third-party vulnerability. We are not aware of any incident affecting SIA Connect customers.

CVE-2026-109618 is a memory corruption flaw in how PHP handles running out of memory while it processes a request. It can be triggered by a specially crafted web request, for example a form-based file upload (multipart/form-data), before any login takes place. CVE-2026-109619 lets internal data from an earlier request be reused after its memory has been freed. One confirmed way to trigger it is through PHP's session upload progress feature. Both vulnerabilities could allow an unauthenticated attacker who can reach the web interface over the network to run code on the device.

We will update this entry when fixed versions are available.

Authenticated command injection in diagnostic ping functionality
The diagnostic ping functionality insufficiently validates user-supplied input, allowing an authenticated user with access to the SIA Connect management interface to execute certain operating-system commands.

Successful exploitation could allow an authenticated user to execute commands on the device. Exploitation requires a valid, authenticated session in the Edge Portal.