On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Japan's Information-technology Promotion Agency (IPA) issued an advisory on the same day.

Our parent company, NEOJAPAN Inc., has reviewed its products and confirmed that desknet's NEO, AppSuite and ChatLuck do not use PHP and are not affected by these vulnerabilities, in both their on-premises and cloud editions. Customers do not need to take any action.

About the vulnerabilities

According to the PHP project, the two vulnerabilities can allow unauthenticated remote code execution on servers running PHP to handle web requests. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

  • CVE-2026-109618: remote code execution through out-of-memory handling
  • CVE-2026-109619: remote code execution through internal state that survives between requests

If you run your own servers

This notice covers NEOJAPAN products only. If PHP is installed on the same server as an on-premises edition of our products, for example to run another application, it is not covered by this assessment. Please update PHP on that server in line with your organisation's IT security policy.

Full list of NEOJAPAN products confirmed not affected

The following products and services, as provided in NEOJAPAN's standard offerings, do not use PHP.

On-premises editions

  • desknet's NEO / AppSuite
  • ChatLuck
  • Denbun POP Edition / IMAP Edition
  • desknet's CAMS
  • desknet's DB
  • desknet's SSS
  • desknet's DAX

Cloud editions

  • desknet's NEO / AppSuite
  • ChatLuck
  • desknet's DB

Sources

Published 22 October 2026. Last updated .