SECURITY ASSESSMENT & RESPONSE
November 2026 | D-Link Corporation
D-Link Security Assessment and Response Regarding the PHP2Shell Critical Vulnerabilities
In response to the recently reported critical security vulnerabilities affecting PHP core components (CVE-2026-109618 and CVE-2026-109619), collectively referred to as “PHP2Shell,” D-Link promptly initiated a comprehensive security review and risk assessment covering its products, applications, firmware, and related cloud infrastructure.
As of November 2026, the latest investigation findings and mitigation progress are outlined below.
1. Security Assessment of Products and Services
Networking Hardware Not Affected
D-Link confirms that its currently marketed networking hardware, including enterprise and consumer switches, routers, wireless access points (APs), and network cameras, does not use PHP components in its underlying operating systems or firmware architecture. Therefore, these products are not affected.
Applications and Mobile Apps Not Affected
Following a comprehensive review, D-Link confirms that its product management tools, companion software, mobile applications (Apps), and backend API communication architecture do not incorporate PHP components associated with these vulnerabilities. Therefore, these applications and services are not affected.
mydlink Cloud Services Emergency Risk Mitigation Completed
A comprehensive review identified that certain legacy web frontend components of the mydlink portal cloud platform previously utilized a PHP-based architecture. D-Link has conducted security reviews and risk assessments of the relevant components. To date, D-Link has found no evidence of unauthorized data access resulting from exploitation of these vulnerabilities.
2. Mitigation Measures and Improvement Plans
Immediate Security Protection Completed
D-Link has completed emergency remediation and security protection measures for the relevant cloud platform. Corresponding security rules have also been deployed on the frontend Web Application Firewall (WAF) to detect and block currently known automated attack vectors, thereby reducing potential security risks.
Platform Architecture Modernization In Progress
To further enhance the platform's overall security and long-term operational resilience, D-Link is actively modernizing the technical architecture of the mydlink portal, progressively replacing the existing PHP components and migrating to a next-generation architecture. The new architecture is scheduled for completion and deployment by the end of November 2026, ensuring continued service stability throughout the upgrade process.
D-Link considers information security and user privacy to be fundamental corporate responsibilities. We will continue to monitor the global cybersecurity threat landscape and strengthen security monitoring, vulnerability management, and other protective measures to safeguard our products and services, while protecting the digital assets and privacy of users worldwide.
For further technical information, please contact your local D-Link team.
D-Link Corporation
security@dlink.com
November 2026