Regarding critical PHP vulnerabilities disclosed on 21 October 2026, the Ricoh Group is investigating their impact on its websites, products and services and is taking necessary measures.
The critical PHP vulnerabilities disclosed in 2026, CVE-2026-109618 and CVE-2026-109619, could allow a remote third party to execute arbitrary code if exploited. In response, the Ricoh Group is assessing the impact on websites, products and services that it provides and operates.
As part of its response at this stage, the Group is collecting information and investigating the impact on systems that may be affected, while implementing necessary measures. If guidance for customers becomes necessary, it plans to publish information on the pages for relevant products and services and on the websites of its group companies.
As reference information, the Group is consulting relevant alerts issued by the US CISA and the EU’s CERT-EU, and is expected to proceed with its response based on this information.
The Ricoh Group is prioritizing the security of its websites, products and services as a whole and plans to disclose the status of its impact assessments and countermeasures in a timely manner.