TDSi products not affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

TDSi by Hirsch, confirms that no TDSi products are affected by CVE-2026-109618 or CVE-2026-109619, the critical PHP vulnerabilities known as “PHP2Shell”. No TDSi product is built with PHP or depends on it, so customers do not need to take any action on their TDSi systems.

Background

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in the core PHP runtime. They can allow an unauthenticated attacker to execute code remotely on systems running affected PHP versions. Many organisations have asked their vendors to confirm whether their products are exposed.

Impact on TDSi products

We have reviewed our product portfolio. PHP is not used in any TDSi software application, controller firmware or web-based management interface, and no TDSi product installs or requires a PHP runtime. TDSi products are therefore not vulnerable to these CVEs.

Products covered

This statement applies to all currently supported TDSi products, including:

• GARDiS (software and controllers)
• Exgarde Web

Customer recommendations

This bulletin covers TDSi products only. Servers, operating systems and other third-party software running alongside your TDSi system. Please check these and follow the guidance from the relevant vendors.

Our commitment

TDSi continuously monitors security advisories and assesses whether they affect our products. If that changes for any TDSi product, we will notify customers promptly and update this bulletin.

Contact

For questions about this bulletin, please contact TDSi Technical Support at support@hirschsecure.co.uk or your TDSi account manager.