Overview
RAKwireless confirms that WisGateOS2 gateways, WisDM, and RAK ID are not affected by CVE-2026-109618 or CVE-2026-109619.
These vulnerabilities are associated with PHP, which is not used in the affected components of the RAKwireless gateway firmware or cloud infrastructure.
WisGateOS2 Gateway Security
WisGateOS2 is the operating system used across the WisGate Edge, WisGate Soho, and WisGate X gateway families.
WisGateOS2 does not include a PHP interpreter or rely on PHP-based services. Its web management interface uses Nginx with a Python-based backend, eliminating exposure to these PHP-specific vulnerabilities.
As a result:
- WisGateOS2 gateways are not affected by CVE-2026-109618 or CVE-2026-109619.
- No PHP-specific mitigation or configuration changes are necessary.
- No firmware update is required specifically to address these vulnerabilities.
This applies to all supported WisGate Edge, Soho, and X gateways running WisGateOS2.
WisDM and RAK ID Cloud Infrastructure
The same assessment applies to WisDM and RAK ID, RAKwireless cloud-based gateway management and identity services.
The RAKwireless cloud infrastructure uses the following technologies:
| Component | Technology |
|---|---|
| Online services | Amazon S3 and Amazon CloudFront |
| API endpoints | AWS API Gateway |
| SSH tunnel endpoint | Nginx |
These components do not rely on PHP-based services and are therefore not affected by the two identified vulnerabilities.
No customer action is required for WisDM or RAK ID in relation to CVE-2026-109618 and CVE-2026-109619.
Security Recommendations
Although these vulnerabilities do not affect WisGateOS2 or the identified RAKwireless cloud services, we recommend keeping gateways updated to the latest available firmware.
Regular firmware updates provide access to security improvements, bug fixes, stability enhancements, and new features.
For WisGateOS2, customers should check the latest firmware available for their specific gateway model.
Conclusion
CVE-2026-109618 and CVE-2026-109619 do not affect RAKwireless gateways running WisGateOS2, WisDM, or RAK ID.
No PHP-specific mitigation, configuration change, or firmware update is required to address these vulnerabilities.
RAKwireless remains committed to maintaining the security and reliability of its gateway products and cloud services.
Updated