Security Advisory – Statement on the Use-After-Free Vulnerabilities (CVE-2026-109619, CVE-2026-109618) in PHP2Shell Post-Release
On October 21,2026, the official PHP team disclosed high-risk remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). These are unauthenticated remote code execution vulnerabilities that allow attackers to execute arbitrary code by crafting malicious requests.
Upon receiving the vulnerability alert, HaiSoft immediately launched a comprehensive asset investigation and security assessment targeting the software products in its solutions, including verification of system component lists, service dependencies, operating environments, and underlying software stacks, to confirm that the company's software products do not use PHP components, have no Attack Surface for this vulnerability, and are not affected by the aforementioned vulnerability.
Hai Robotics will continue to follow up on various security vulnerability alerts, conduct regular product security self-inspections, version baseline audits, and supply chain security management and control, so as to ensure the stable and secure operation of Hai Robotics' product systems.
If you have any other security-related questions, you can contact the security liaison email: [swsecurity@hairobotics.com]