Clear-Com Issues Statement on PHP Vulnerabilities

Clear-Com is issuing guidance to customers about PHP vulnerabilities.

In recent days, the issue has become a major concern. According to the BBC:

"Researchers who helped surface the vulnerabilities in PHP -- a popular server-side programming language used in web development for decades -- warned platforms which use it could be exposed to potential hacks.

"Governments and cyber-security agencies rushed to contain the fallout, urging website owners to check if their sites were affected and, if so, install updates to patch the issue or consider going offline.

"There have been no reports of any successful exploits of the flaw, coined php2shell, so far."

To reassure its customers, Clear-Com's statement reads:

"Clear-Com is aware of the recently disclosed PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, sometimes referred to as "PHP2Shell."

"We understand that customers want to confirm whether their Clear-Com systems are affected.

"Based on our review, none of the following use PHP, and they are therefore not affected by these vulnerabilities.

"Currently shipping hardware products, including their web-based interfaces are Eclipse HX (Delta, Median, and Omega), Eclipse HX network interface cards (E-IPA, E-DANTE, IVC-32, LMC-64, and E-QUE), Arcadia Central Station and Avalon IP Station, FSII-Base-II Wireless Base Station, Equip Wireless System, and V-Series, Iris and IrisX.

"Configuration and management software are Eclipse HX EHX and Arcadia/Avalon/FSII-Base-II CCM.

"Cloud and remote services are Gen-IC and SkyPort.

"Clear-Com discontinued its last product that used PHP, the Concert system, in 2017. Concert is no longer supported and may be affected by these vulnerabilities.

"If your organization still operates Concert, we recommend taking the Concert server offline and contacting your Clear-Com representative.

"We will work with you on a migration plan to a current Clear-Com solution, and we will provide migration planning assistance at no charge.

"Clear-Com monitors published security vulnerabilities that affect technologies used in our products. If we identify an impact on any Clear-Com product, we will notify affected customers and provide guidance.

"This statement is based on information available as of the date above. If you have questions, please contact your Clear-Com representative."