Impact of PHP Vulnerabilities on Our Products

On October 21, 2026, information regarding critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS score: 9.2), along with the corresponding security patches, was released.

Among our products, the potentially affected products and software are limited to the RDX QuikStation models with a web-based management interface (QuikStation4, QuikStation8, and QuikStation8_10G), as well as the discontinued NEOs and NEOxl series of LTO autoloaders and libraries.

Regarding the NEOs and NEOxl series, we will provide further updates once we have received confirmation from the manufacturer.

Please note that the previous-generation QuikStation models (model numbers 8900/8910) and ImationT8 are not eligible for this patch, as more than 10 years have passed since their discontinuation and more than five years have elapsed since the end of service life (EOSL).

This document provides details on the scope of impact and instructions for applying the emergency mitigation patch for the RDX QuikStation models (QuikStation4, QuikStation8, and QuikStation8_10G). Please refer to the document below for further information.

QuikStation is not a product that is publicly accessible while handling confidential customer information, as is the case with public websites or web services. Rather, it is a storage device used for backup purposes over a one-to-one iSCSI connection, rather than as network-shared storage like a NAS.

Therefore, this is not the type of product in which a vulnerability in the management interface would immediately pose a major risk. However, considering the potential impact of this vulnerability across the market, we strongly recommend applying the security patch.

Security Patch Advisory Page

https://quikstation-patch.pages.dev/en

2026Oct23 Ver.A