CVE-2026-109618 / CVE-2026-109619, Xerox AltaLink, EC81xx, VersaLink and WorkCentre printers and Fiery print controllers: Xerox lists them as affected by the PHP2Shell flaws, with fixes expected on 2026-11-06 and Fiery patches between 2026-11-09 and 2026-11-23
PHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November
Analysis
Xerox's security bulletin XRX26-016, published 2026-10-23 and updated on 2026-10-28, lists Xerox AltaLink and EC81xx products, VersaLink C/B415, C/B625 and C/B620, WorkCentre 3655, EC7836 and EC7856, the Fiery Digital Front End and the Worldwide Ticketing Tool as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619 (Xerox, 2026-10-28). No fixed build is out: Xerox says the AltaLink, EC81xx and VersaLink fixes are being tested and expected on its website on 2026-11-06, the WorkCentre models and the Ticketing Tool are in development, and Fiery's target patch dates are by 2026-11-09 for FS800, FS700, FS600 and FS500 including the Pro editions, by 2026-11-16 for FS400, FS350 and FS300, and by 2026-11-23 for FS200 (Xerox, 2026-10-28). The bulletin does not name the affected interface or PHP version, offers no workaround and reports no attack on these devices, while CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 and describes each as allowing unauthenticated remote code execution in PHP (CISA KEV, 2026-10-30).
Cited evidence
Xerox is aware of the recently disclosed critical vulnerabilities in the PHP runtime
Fix being tested. Expected to post to web November 6, 2026.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.