Critical
vulnerabilities in the PHP component (CVE-2026-109618,
CVE-2026-109619)
| First published | 23/10/2026 |
| Last updated | 27/10/2026 |
| Advisory version | 1.1 |
| Severity | Critical (CVSS v4.0 9.2) |
| Status | CamJ: fixed firmware available. CamX: fix in preparation. Protective measures to be applied now |
Summary
On 21 October 2026 the PHP project disclosed and fixed two critical
vulnerabilities (CVE-2026-109618, CVE-2026-109619), known as
“PHP2Shell”, which may allow remote code execution without credentials.
Selea cameras of the CamJ and CamX series use PHP in their web interface
and are affected (list of models below).
For CamJ cameras the fixed firmware 261022125555 is available; for
CamX cameras the fix is in preparation. Until the update is
installed, the web interface of the cameras must not be reachable from
the Internet or from unauthorised systems.
Distribution partners and, through them, installers and customers are
receiving detailed instructions.
Affected products
| Series | Models | Fix status |
|---|---|---|
| CamJ | J-T306, J-T506, J-T560, J-T706 (incl. Targa 706 ILB), J-T760, J-T806, J-T860, J-T950, J-T960, J-IZERO2, J-IZERO3 |
fixed in firmware 261022125555, available from 26/10/2026 in the Selea support area: DOWNLOAD FIX |
| CamX | X-T205, X-T206, X-T504, X-T512, X-T704, X-T710INOX (Targa INOX), X-T750, X-T804, X-T805, X-T806, X-T850, X-TSE (Targa Semplice), X-OCRBOX, X-TARGASCANNER, E-IZERO (incl. iZero BOX), E-OCRBOX |
fix in preparation; this advisory will be updated when it is available |
Models no longer in production listed above are also affected. Based
on the technical checks carried out so far, the affected models are
those listed above.
What to do now
- Do not make the cameras reachable from the
Internet: remove any port forwarding to the cameras on the
router; use a VPN for remote access. If this is not immediately
possible, temporarily disconnect the cameras from the Internet until
they are updated. - Restrict access to the web interface of the cameras
to authorised systems only (video recorders, management software,
technicians’ workstations). - CamJ: install firmware 261022125555, from the local
network or via VPN. The installed version is shown in the web interface
under Setup → System → System info. - CamX: install the update as soon as it is
available; until then, measures 1 and 2 are essential.
Changing passwords is always good practice, but it does not protect
against these vulnerabilities.
To apply these measures and to update the firmware, please contact
your installer or distributor.
For information: assistenza@selea.com.
Exploitation status
Security vendors report attempts to exploit these vulnerabilities on
the Internet against systems using PHP. To the best of Selea’s
knowledge, no compromise of Selea products has been reported. Selea is
monitoring the situation and will update this advisory.
Reporting vulnerabilities
To report security issues in Selea products:
assistenza@selea.com.
References
- PHP — security releases announcement of 21 October 2026:
https://www.php.net/archive/2026.php - PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618):
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w - PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619):
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Advisory history
| Date | Version | Change |
|---|---|---|
| 23/10/2026 | 1.0 | First publication |
| 27/10/2026 | 1.1 | CamJ firmware 261022125555 available; affected products and exploitation status clarified |