In response to the recently disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Splashtop has confirmed that these vulnerabilities do not affect any Splashtop products or services.
PHP has never been used in the core components of Splashtop products. It is used only in certain auxiliary functions that do not handle customer information. Upon learning of these vulnerabilities, we promptly upgraded the affected PHP servers to version 8.5.12, which addresses the reported vulnerabilities.
There has been no impact on customers, and no customer data has been exposed as a result of these vulnerabilities.
If you have any further questions, please contact Splashtop Support. Thank you for your continued trust and support.