Applies to: WAVE

Issue Summary

Two critical PHP vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are public. CVE-2026-109618 and CVE-2026-109619 are critical flaws in the PHP core, which allow an unauthenticated attacker to run code remotely on a web server that uses PHP. A working exploit is publicly available, and attacks are ongoing.

This article explains what the vulnerabilities are and confirms that Wisenet WAVE VMS products are not affected. This article details the recommended steps to protect your WAVE Sync accounts if you used your password on other websites.

Resolution

Wisenet WAVE VMS products do not use PHP and are not affected by CVE-2026-109618 or CVE-2026-109619. This includes:

• Wisenet WAVE VMS
  • Wisenet WAVE Media Server and Server Web Client
  • Wisenet WAVE Desktop Client and Wisenet WAVE Mobile Client
  • Wisenet WAVE Sync Cloud Web Client

No action is necessary; you do not need to update or reconfigure your system due to these vulnerabilities.

Although Wisenet WAVE VMS products are not affected, many other websites and web applications run on PHP. If an attacker compromised one of those applications, they could have stolen the passwords stored there. If you used the same password for a Wisenet WAVE system or account and for any other application, an attacker could reuse it to sign in to your System or your Wisenet WAVE Sync Cloud account if 2FA is not enabled.

If you reused a password, change it for the following accounts:

• Local System users: Change the password of each local user that shares a password with another application.
   
• Wisenet WAVE Sync account: Sign in to WAVE Sync and change your account password.

For password requirements and instructions for each account type, see How do I reset my WAVE and WAVE Sync passwords?