WebSupervisor and AirGate running smoothly, without being affected by the PHP vulnerabilities

On 21 October 2026, the PHP project announced two critical vulnerabilities in the core PHP runtime, CVE-2026-109618 and CVE-2026-109619. We would like to assure our customers that neither ComAp’s WebSupervisor nor AirGate was impacted, as they do not use the affected PHP runtime.

PHP is a popular server-side programming language that has been used for decades and currently powers around 70% of websites with a known server-side language. Both PHP vulnerabilities are rated critical (CVSS 9.2) and can allow unauthenticated remote code execution and memory disclosure in applications that run on affected PHP versions.

WebSupervisor, including its web application, mobile app and API, does not use the affected PHP runtime. The same applies to ComAp’s AirGate 1 and AirGate 2 remote connectivity services: neither uses the affected PHP runtime, so remote connections between controllers and WebSupervisor or ComAp PC tools through AirGate are not affected.

Therefore, our customers can rest assured their data, energy assets and WebSupervisor account are not exposed to these vulnerabilities, and they do not need to take any action.