PHP Vulnerability Responses by Company

Utimaco

Global cloud / infrastructure
Aliases / services
Utimaco / Utimaco Inc. / Utimaco GmbH / Utimaco Management Services GmbH / Utimaco IS GmbH / CryptoServer / Atalla AT1000 / Enterprise Secure Key Manager / LAN Crypt
Official website
https://utimaco.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

u.trust GP HSM Se/CSe-Series / CryptoServer

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

HSM, key management, encryption and data protection products.

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

Atalla AT1000

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

CryptoSec Payment HSM

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

Enterprise Secure Key Manager（ESKM）

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

KeyBridge Suite

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

LAN Crypt Cloud

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

LAN Crypt Client（iOS/Android/macOS/Linux）

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

LAN Crypt 2Go

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

DiskEncrypt

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

u.trust 360

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

Utimaco C3

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence

Listed admin tools, PKCS#11/JCE/CNG providers and smartcards

Response status
Reported unaffected: no PHP dependency
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 23 PSIRT bulletin states these products use no PHP in firmware, OS images, management interfaces or supporting tools.

Scope: Explicit bulletin scope. Operating-system and URL variants are not duplicate services; affiliated legal entities are not treated as identical.

What users should do

No issue-specific product action is required according to Utimaco; update separate PHP systems in your environment.

Source URLs

  1. PHP2Shell response and scopehttps://support.hsm.utimaco.com/documents/d/20182/cve-2026-109618_cve-2026-109619_php-vulnerabilitiesResponse evidence
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments