CVE-2026-109618 and CVE-2026-109619: PHP

These PHP vulnerabilities were announced in October 2026. At this time, Ricoh production printing software and websites are not subject to these vulnerabilities.

These Ricoh products do not use PHP and, as a result, are not subject to the vulnerabilities:

  • RICOH Auto Color Adjuster
  • RICOH InfoPrint Manager
  • RICOH ProcessDirector
  • RICOH TotalFlow Cloud products:
    • RICOH Account Administration
    • RICOH Predictive Insight
  • RICOH TotalFlow Optimizer (formerly RICOH BatchBuilder)
  • RICOH TotalFlow Prep
  • RICOH TotalFlow Production Manager
  • RICOH Transforms Suite
    • AFP2PDF Plus
    • AFP Merge
    • AFP Visual Environment
    • Line2PDF Plus
    • PCL2PDF
    • PS2PDF
    • PDF2PDFUA
    • RICOH Accessibility Designer
    • RICOH InfoPrint XT
    • TIFF2PDF

The only Ricoh production printing website that used PHP is https://dl.ricohsoftware.com, the website that customers use to download product code. That website was patched on October 21, 2026, and is no longer subject to these vulnerabilities.

Parent topic: Security Vulnerability updates