Splashtop has reviewed the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (also known as “PHP2Shell”).
These vulnerabilities are in the PHP runtime and affect only systems that use PHP. Splashtop On-Prem products are not built on PHP and do not include or run any PHP components, so the vulnerable code is not present.
The following products are not affected on any supported platform:
- Splashtop Gateway
- Splashtop Client app
- Splashtop Streamer
- Splashtop SOS
- Splashtop Connector
No action is required for these products.
If PHP is installed on servers in your environment for other purposes, we recommend updating to a fixed PHP version from your OS vendor or the PHP project.