PHP Security Attestation

CVE-2026-109618 · CVE-2026-109619 · Disclosed 21 Oct 2026

Not Affected

§ 01 · StatementSummary of position

Color-Logic, Inc. confirms that no product in its catalogue, and no customer-facing infrastructure under its control, is affected by the PHP core vulnerabilities disclosed on 21 October 2026.

No Color-Logic product uses PHP. No remediation is required by Color-Logic, by its partners, or by its customers. This attestation is issued proactively in response to enquiries from enterprise customers.

§ 02 · ScopeProducts covered

This attestation covers the Color-Logic product catalogue in full:

The Color-Logic SystemDesign suite

Metallic colour design, specification & licensing system
FX-ViewermacOS native

Desktop viewer for foil & metallic ink renderings

§ 03 · ArchitectureWhy the vulnerability does not apply

The Color-Logic System is a design, specification and licensing suite. It contains no PHP component in any part of its codebase, delivery mechanism, or supporting services.

FX-Viewer is a native desktop application for macOS. It performs rendering and file inspection locally on the user's machine. It has no server-side component, no web interface, no management console, and no PHP interpreter in its runtime or dependency graph.

The vulnerabilities described in CVE-2026-109618 and CVE-2026-109619 are defects in PHP core and apply only where a PHP runtime is present. Neither Color-Logic product carries a PHP runtime.

§ 04 · AdvisoryReference details

Advisory date: 21 October 2026
CVE identifiers: CVE-2026-109618 · CVE-2026-109619
Patched versions: 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35
End-of-life: 8.1 and earlier branches
Source of truth: php.net / security

§ 05 · QuestionnaireCorporate response

Direct responses to the seven questions circulating regarding corporate security on 21 October 2026. The same seven points serve as a template for other enterprise procurement teams; this page can be used by any Color-Logic customer, licensee or certified printer for the same purpose.

Does your product or service use PHP anywhere in its customer-facing application, web interface, management interface, server components, or hosted infrastructure?

No. No Color-Logic product uses PHP in any component. The Color-Logic System is a design and licensing suite with no PHP code. FX-Viewer is a native macOS desktop application with no server-side component and no PHP runtime.

If PHP is used, what PHP version is currently running?

Not applicable. PHP is not installed, not referenced, and not required by any Color-Logic product.

Is any portion of the product or service running an outdated or end-of-life version of PHP?

No. No PHP is in use, current or otherwise. End-of-life PHP 8.1 and earlier branches cannot apply where no PHP is present.

Is the product or service affected by CVE-2026-109618 or CVE-2026-109619?

No. Both CVEs are defects in PHP core. Color-Logic products contain no PHP core, no PHP-FPM, no mod_php, no php-cgi, no FrankenPHP and no LiteSpeed PHP interpreter. The vulnerable attack surface does not exist in Color-Logic's codebase or runtime.

If affected, has a security update or patch already been applied? If not, what remediation is required?

Not applicable. No remediation is required. Color-Logic is not shipping any update or hotfix in response to this advisory because no Color-Logic product is affected.

Has the vendor identified any evidence that the vulnerability has been exploited or that the environment has been compromised?

No. No evidence of exploitation or compromise, in-product or in Color-Logic infrastructure, has been observed. The attack class described in the advisory requires a PHP runtime to be present on the target; none is.

Are there any actions required for our customers?

None. No action is required in relation to Color-Logic products.

§ 06 · WebsiteMarketing & informational site

Color-Logic's informational website is hosted on IONOS shared web hosting. The site is a read-only promotional and documentation surface. It does not hold customer production data, does not carry authentication into Color-Logic products or licensing systems, and is not part of the Color-Logic product perimeter.

Where PHP is present on the site — typically for the content management system — it is managed and patched by IONOS across their shared hosting platform in accordance with IONOS's standard security update process. No action is required of Color-Logic.

§ 07 · DistributionKhaos Technology products

Color-Logic, Inc. is the authorized distributor for all products developed by Khaos Technology Ltd (Yorkshire, United Kingdom). Our distribution portfolio is covered by a parallel attestation from the manufacturer:

Related attestation

Khaos Technology Ltd — also unaffected

Khaos Technology has issued its own PHP Security Attestation (Ref KT-SEC-2026-01) confirming that none of its products use PHP and that none are affected by CVE-2026-109618 or CVE-2026-109619.

Products covered: Visualis3R, Touch7, EVE, and the Khaos API. All are Electron desktop applications or Node.js services with no PHP in the stack.

The Khaos attestation is available on request from Khaos Technology Ltd at support@khaossystem.com.

§ 08 · VerificationSignatory and contact

This attestation is issued by Color-Logic, Inc. and may be verified in writing. A signed copy on company letterhead is available on request for compliance and procurement files.

Signatory

Richard Ainge
Chief Technology Officer
Color-Logic, Inc.

Contact

info@color-logic.com
Color-Logic, Inc.
[West Chester, Ohio · United States]

We use anonymous session cookies (short-term cookies that disappear when you close your browser) to help you navigate the website and make the most of the features. For more information please view our GDPR and Privacy Policy