JP — ITmedia

NEC's Aterm Routers Not Affected by PHP Vulnerabilities; ".php" in Settings Page URL Is Unrelated

SecurityOctober 27, 20261 min read

NEC said its Aterm Wi-Fi and mobile routers are not affected by two recent PHP security flaws. A “.php” text in the router’s settings page address does not mean the router uses PHP.

NEC says Aterm routers are safe

On October 26, 2026, the Aterm information site said it checked and confirmed that Aterm products and services are not affected by two PHP vulnerabilities. The flaws were published on October 22. Some Aterm models show “/index.php” in the address of their settings page, “Quick Setup Web.” The company says this is not a problem. The “.php” is just text in the web address, and the router does not actually run PHP.

Key facts

The two flaws have IDs CVE-2026-109618 and CVE-2026-109619.
The flaws were published on October 22, 2026.
NEC announced the result on October 26, 2026.
NEC says it will post any new information on the same page.

What is PHP?

PHP is a popular programming language used to build websites. A security flaw, or vulnerability, is a weak spot that attackers can use. When a flaw is found in PHP, many companies check whether their own products use it. Seeing “.php” in a web address alone does not prove that PHP is running.

Why it matters

Many people use Aterm routers at home and at work, so they may worry about security. This news shows that a company can check a flaw and say clearly whether its products are at risk. It also shows that a file name ending in “.php” does not always mean a product uses PHP.

What to watch

NEC will update its Aterm information page if it finds new facts.
Check the Aterm official site for the latest notices.
Install security updates from other companies when they are released.

Glossary

Aterm: NEC’s brand of Wi-Fi and mobile routers, the boxes that connect devices to the internet.
PHP: A programming language used to build websites and web services.
CVE: A standard ID number given to a known security flaw so people can talk about it clearly.

Japanese virtual desktop cloud hacked so hard it asks to be banned

GMO Internet warned customers that its Onamae.com Desktop Cloud, a virtual desktop service it recommended for foreign exchange trading, was compromised by an attacker and that it had been slow to improve the service's security. The company says an attacker demanded $50 million, which GMO has refused to pay, and that 26,739 VDI servers may have been affected. GMO is offering customers a ¥5,000 condolence payment and has advised users to change trading passwords and disconnect active sessions.

SecurityITmediaOct 27

JR Smart EX and Express Reservation member email addresses possibly leaked, about 170,000 records, after unauthorized access to Yumilink

JR Tokai, JR West, and JR Kyushu announced on October 26 that some member email addresses, member IDs, names in katakana, and membership types for their Express Reservation and Smart EX services may have leaked. The number of affected records is still being confirmed, but they have reportedly received a preliminary figure of about 170,000. The leak stems from unauthorized access to Yumilink, the provider of the mail delivery service, and JR Tokai has not confirmed any leak from its own systems for either service.

SecurityThe RegisterOct 27

LiteLLM supply chain attack started with an exposed master key

LiteLLM traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, which was not revoked after the commit was removed. The attacker used the key to access the company's AI agent platform and steal a GitHub CLI OAuth token, gaining owner-level access to its GitHub repositories. A poisoned version (1.107.0) of the package, which contained an infostealer and a remote access trojan, was available on PyPI for under two hours and was downloaded about 49,000 times, according to Wiz.

SecurityZDNet KoreaOct 27

"Threatening the Entire Server Ecosystem"... After PHP, Security Vulnerability Found in Node.js Too

A critical vulnerability dubbed "Node2shell" (CVE-2026-111497) has been found in Node.js, the JavaScript server runtime, following a similar PHP flaw. AI offensive security firm Theori says it reproduced and verified the flaw, which stems from an out-of-bounds write in the Brotli decompression module and can allow denial of service or remote code execution without authentication. Node.js versions 22.x, 24.x, and 26.x without the latest security patches are affected, and Theori urges immediate updates to 22.23.4, 24.22.1, or 26.12.1 or later.