CPA2026-008: Critical Vulnerabilities in PHP

October 23, 2026
Updated October 30, 2026

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified in PHP that may allow unauthenticated remote code execution.

We have been investigating the impact of these vulnerabilities on Canon-branded products and services. We have completed the assessment of many of products and services and as a result, no adverse impact on customers has been confirmed at this time. For the Canon-branded products and internet services identified through our assessment to date, the necessary updates have been applied, with no customer action required. We are continuing to assess the remaining Canon-branded products and services.**

We do note that the following Canon USA applications and services were impacted by the above PHP vulnerabilities but were promptly patched:

• Scan for QuickBooks Online (Web Version for QBO users)*
• R40 Receipt Edition Software Installer for Windows*
• R40 Receipt Edition Software Installer for Mac*
• CaptureOnTouch Scan to QuickBooks Online Plugin Pro for macOS*
• CaptureOnTouch Scan to QuickBooks Online Plugin Pro for Windows*
• CaptureOnTouch Scan to Legal Case Plugin for Windows*
• Quick Scan (Box Users)*
• LFP e-Service*

Canon takes security vulnerabilities seriously and strives to make sure that our customers can use our products and services with confidence. The impacted applications noted above have been patched on cloud-based systems where the PHP component was present. No further customer action is required.

At this stage of our investigation, we have also concluded that the following Canon affiliated products are not impacted:

• Readiris PDF, IRISPowerscan, IRISPulse, IRISOCR, and IRISXtract
• Therefore™ Online and Therefore™ On-Premises
• uniFLOW Online, and uniFLOW Server
• ONYX Align*
• ONYX Thrive, ONYX PosterShop and ONYX RIPCenter, all supported versions, including bundled components such as ONYX Cut-Server, Media Manager, Dashboard and Layout Tool*

If we determine that additional products or services could be impacted by these vulnerabilities, this notice will be updated accordingly.

• October 30, 2026: Updated investigation status for Canon-branded products (**)
• October 28, 2026: Updated impacted and not impacted product list (*).
• October 23, 2026: Created.