Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are being actively exploited worldwide.
Keypro’s main products (KeyCom, KeyAqua, KeyHeat, and KeyLight) are not affected. The vulnerability affects only a PHP module in a helper service used for printing, which was kept for backward compatibility. Keypro has removed this module from all SaaS environments, and they are secure as of 21 October 2026 at 16:15 UTC. No action is required from SaaS customers.
Printing: A small number of customers may still experience printing issues. We are working to resolve this as soon as possible.
On-premises customers: The same fix, removing the affected PHP module from the printing service, is required. Keypro will contact affected customers with instructions.
For questions, please contact support@keypro.fi.