Serious security vulnerabilities in PHP* have been announced (CVE-2026-109618 and CVE-2026-109619, known as “php2shell”). They could allow arbitrary code to be executed remotely. SATO Group is currently assessing the impact on our products and services and implementing the necessary security measures.
We have confirmed that some of our products use affected versions of PHP and have implemented the necessary security measures.
Our findings to date are as follows:
Unaffected Products (No PHP in use)
- CL4NX、CL4NX-J Plus、CL4NX-Plus、CL4-SXR
- CL6NX、CL6NX-J Plus、CL6NX-Plus、CL6-SXR
- PW4NX、PW208NX、PW2NX、PW208mNX
- CT4-LX、CT4-LX-HC
- S84/86-NX
- IritoDe
- ASETRA
- Multi LABELIST
- SATO Online Services
Remediated Products (PHP in use; security measures completed)
- SATO App Storage (No related damage has been confirmed at this time.)
- SATO ID AUTH (No related damage has been confirmed at this time.)
We will provide updates on our other products as soon as their status has been confirmed.
For questions and inquiries, please fill out our contact form here.