On October 21, 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) known as php2shell were discovered. Both vulnerabilities can allow an unauthenticated attacker to run malicious code on affected systems. Upon learning of these vulnerabilities, Valcom immediately conducted a thorough investigation and identified affected products.
Valcom developed and is now making available a corrective software patch that addresses the identified vulnerability. Valcom is communicating this notice as part of its ongoing commitment to the security of its customers’ systems.
This notice applies to customers operating the following products:
- Interactive Console, software version 5.4.15 and earlier versions;
- Building Communication Panel, software version 5.4.15 and earlier versions;
- Emergency Communication Panel, software version 5.4.15 and earlier versions;
- Site Manager/Application Server, software version 6.3.1 and earlier versions and 6.3.3 and later versions.
NOTE: Site Manager/Application Server software versions 6.3.2 and 6.6.3 no updated is needed.
ACTION REQUIRED:
Valcom’s records indicate that your company purchased or distributed one or more products that may be subject to this update. Because Valcom may not have direct visibility into all end customers or installation locations for products sold through wholesale distributors, Valcom is requesting that you promptly engage any customers who may have received, installed, or currently operate the affected software products. Please provide those customers with this notice, direct them to the corrective patch and installation instructions immediately.Because these are on-premise installations, Valcom is unable to apply this update remotely. This update requires immediate customer action. The patch and installation instructions are available below or by contacting Valcom support at support@valcom.com
To help enable a smooth upgrade, please access the Valcom Support Portal:
To help enable a smooth upgrade, please click here to access our Knowledge Article which includes links to documentation and security updates that are available on Valcom’s Support Portal.
We strongly encourage all affected customers to apply this update immediately. Customers who obtained this software through a reseller or distributor are encouraged to contact their reseller for installation assistance. For additional questions, please contact Valcom at support@valcom.com or 540-563-2000.
Valcom is continually improving our ability to proactively identify and notify you of vulnerabilities in our software.