Applies to: BioStar X, BioStar 2, BioStar Air, CLUe, Airfob Portal
Last updated: October 22, 2026


We would like to confirm that Suprema's cloud services and on-premise access control software are not affected by PHP2Shell.


Summary

The Suprema products below do NOT use PHP. They are NOT affected by the two PHP security vulnerabilities disclosed on October 21, 2026. No patch is required.

  • BioStar X
  • BioStar 2
  • BioStar Air
  • CLUe
  • Airfob Portal


Details

Vulnerabilities

  • CVE-2026-109618
  • CVE-2026-109619

Findings

  • Suprema reviewed the components of the five products above.
  • These products do NOT use PHP components.
  • These vulnerabilities do not affect the functions or data of these products.


Frequently Asked Questions

Q1. Do these products use PHP?
No. BioStar X, BioStar 2, BioStar Air, CLUe, and Airfob Portal do not use PHP.

Q2. Do these products use an affected PHP version?
Not applicable. These products do not use PHP.

Q3. Do I need to apply a security patch?
No. These products are not affected, so no patch is required.

Q4. When will the fix be completed?
Not applicable.


Notes

  • This article applies only to the five products listed above.
  • This review does not cover third-party systems or integrated servers that you operate with these products. Contact the vendor of each system to check its PHP usage.
  • We will update this article if new information becomes available.