PHP Vulnerability Responses by Company

NEC

Japan-based services
Aliases / services
NEC / 日本電気
Official website
https://jpn.nec.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Linux Service Set (PHP on RHEL 8, 9 and 10)

Response status
Customer update required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Publishes product security information for enterprise IT products and services.

The October 22 notice directs customers to update PHP on RHEL 8, 9 and 10 using the corresponding Red Hat fixed packages or later updates.

Scope: This is customer remediation guidance, not confirmation that all NEC environments are patched.

What users should do

Apply the appropriate official errata and verify application behavior.

Official service URL

Source URLs

  1. https://jpn.nec.com/linux/linux-os/ss/php_errata.htmlhttps://jpn.nec.com/linux/linux-os/ss/php_errata.htmlResponse evidence

UNIVERGE IP8800

Response status
Not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice states that the series does not use PHP and is unaffected by both CVEs.

Scope: Only the named series is covered.

What users should do

Verify your product series.

Source URLs

  1. https://jpn.nec.com/ip88n/technical_info/20261022.htmlhttps://jpn.nec.com/ip88n/technical_info/20261022.htmlResponse evidence

UNIVERGE QX

Response status
Not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice states that the series does not use PHP and is unaffected by both CVEs.

Scope: Only the named series is covered.

What users should do

Verify your product series.

Source URLs

  1. https://jpn.nec.com/qxseries/vulnerability/2026-109618.htmlhttps://jpn.nec.com/qxseries/vulnerability/2026-109618.htmlResponse evidence

CAE2D products and HOTLINE

Response status
Not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 22 notice states that CAE2D products and the HOTLINE maintenance-customer site are unaffected by both CVEs.

Scope: Does not extend to other NEC products.

What users should do

Verify the product and maintenance site.

Source URLs

  1. https://jpn.nec.com/cae2d/information/inf-index.htmlhttps://jpn.nec.com/cae2d/information/inf-index.htmlResponse evidence

InfoCage SiteShell

Response status
WAF protection guidance
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice describes protection against attacks targeting both CVEs; details are in PP Support contract content.

Scope: WAF protection is separate from patching PHP. Restricted instructions were not retrieved.

What users should do

Check the required configuration in your support instructions.

Source URLs

  1. https://jpn.nec.com/infocage/siteshell/PHP_20261022.htmlhttps://jpn.nec.com/infocage/siteshell/PHP_20261022.htmlResponse evidence
Related official sources
  1. NEC Group product security informationOfficial information directoryReviewed the official information. It does not establish that remediation for these CVEs is complete.

Comments