NV5 Geospatial Software: ENVI and IDL products are not affected by "PHP2Shell" critical security vulnerability issues CVE-2026-109618 and CVE-2026-109619

Updated: 10/26/2026

On October 21, 2026, the PHP developers announced updates to address two critical severity vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 (See also PHP2Shell: Critical PHP vulnerabilities patched, update now! - Help Net Security).

For users of ENVI, IDL and other NV5 Geospatial Software products, the products do not use PHP thus they are not impacted by these vulnerabilities. 

 

Written 10/26/2026 JU; Approved BO, ZN