Fujifilm copiers and the PHP2Shell flaws: what offices should check

Fujifilm (formerly Fuji Xerox) says the copier and printer series it has checked are not affected by the two PHP flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Its notice of 4 November 2026 names Apeos, ApeosPort, ApeosPrint, DocuCentre, DocuPrint and other series. Copiers in those series need nothing for PHP2Shell, but many Apeos models still need an October firmware fix.

What did Fujifilm say?

Two holes in PHP, the software behind many websites and web control pages, can let an outsider with no login run their own code on a machine that uses it. Fujifilm describes them that way on its own healthcare security page.

In a Japanese notice, Fujifilm's office printer business says it has checked these product lines and found them not affected:

• Apeos series, ApeosPort series (serverless) and DocuCentre series (serverless)
• ApeosPort Print, ApeosPrint and DocuPrint printers
• ApeosWide and DocuWide wide format printers
• Able series and EP-BB

The company says it is still checking its other products and services. We could not find an English or Malaysian copy of this notice. Fujifilm does not mention any attacks on its products.

Is there anything else to update?

Yes. On 30 September 2026, updated 13 October, Fujifilm published a separate notice about a path traversal hole in the web management page of many Apeos and ApeosPrint models. Under some conditions it could let someone read information stored on the device. Fujifilm says it had seen no attacks when it published. It lists fixed firmware for each model. For the Asia list many models need 1.50.6 or later, but the number depends on the model, so check the table on Fujifilm's page.

What to do

1. Find your copier's model name on the front panel or the sticker, for example Apeos C3060.
2. Compare it with the affected list in Fujifilm's path traversal notice, linked below.
3. If your model is there, ask your copier dealer or Fujifilm service to install the fixed firmware. Many Malaysian offices lease their copiers, and the dealer can do this during a service visit.
4. Do not let the copier's web page be reached from the internet. It should only open from inside the office network.
5. Change the default admin password on the copier and keep it to the staff who need it.
6. If you are unsure whether the copier is open to the internet, ask whoever looks after your office router.

Source and credit

We are sharing this news from FUJIFILM Business Innovation and FUJIFILM Corporation. This summary is written by Synctech in our own words.

• Notice on PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) in multifunction printers, printers and related products (Japanese), FUJIFILM Business Innovation, 4 November 2026: https://www.fujifilm.com/fb/ja/news/14794
• Notice Regarding Path Traversal Vulnerability in FUJIFILM Multifunction Devices and Printers, FUJIFILM Business Innovation, 30 September 2026, updated 13 October 2026: https://www.fujifilm.com/fb/en/news/15736e
• Product security Advisories: Response to PHP Vulnerabilities (PHP2Shell) (2026), FUJIFILM Corporation (healthcare products): https://www.fujifilm.com/is/en/healthcare/security-information/ff-php2shell-2026

Retrieved 13 Nov 2026. FUJIFILM, Apeos, ApeosPort, ApeosPrint, DocuCentre, DocuPrint and Fuji Xerox are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.