On October 21, 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109219) known as php2shell were discovered. Both vulnerabilities can allow an unauthenticated attacker to run malicious code on affected systems. Upon learning of these vulnerabilities, Valcom immediately conducted a thorough investigation and identified affected products.
Affected customers must update their affected systems immediately.
Valcom developed and is now making available a corrective software patch that addresses the identified vulnerability.
Affected products: Interactive Console software version 5.4.15 and earlier; Building Communication Panel software version 5.4.15 and earlier; Emergency Communication Panel software version 5.4.15 and earlier; Site Manager software version 6.3.1.