NV5 Geospatial Software: ENVI and IDL products are not affected by "PHP2Shell" critical security vulnerability issues CVE-2026-109618 and CVE-2026-109619

Updated: 10/26/2026

On October 21, 2026, the PHP developers announced updates to address two critical severity vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 (See also PHP2Shell: Critical PHP vulnerabilities patched, update now! - Help Net Security).

For users of ENVI, IDL and other NV5 Geospatial Software products (including ENVI SARscape and Opticalscape), the products do not use PHP thus they are not impacted by these vulnerabilities. 

 

Written 10/26/2026 JU; Approved BO, ZN