Customer Support
On October 21, 2026, the PHP Group disclosed two vulnerabilities in the PHP core interpreter: CVE-2026-109618 and CVE-2026-109619, commonly referred to as "PHP2Shell." The vulnerabilities have a CVSS v4.0 base score of 9.2 (Critical). If an attacker exploits them, the attacker could run arbitrary code with the privileges of the PHP process.
Topcon has completed an initial assessment of which products and versions are affected.
Several Topcon products include PHP as a runtime component, and Topcon has completed an initial assessment of which products and versions are affected.
Click Here (a pdf file will open in a new window)
How exposure is determined. An attacker must be able to reach the affected system over the network to exploit these vulnerabilities. Topcon products are intended for use on hospital-managed networks that are protected by access controls and firewalls, so an attacker would first need to gain access to that network. The risk to a specific installation therefore depends mainly on its network exposure. An affected system that is reachable from the Internet or from another untrusted network should be addressed immediately.
Reports of exploitation. As of October 27, 2026, Topcon has received no reports of cyberattacks on, or damage to, Topcon eye care products based on exploitation of these vulnerabilities.
Harmony is not affected. Topcon has confirmed that Harmony software products are not affected by CVE-2026-109618 or CVE-2026-109619. Customers using Harmony, including installations that are reachable from the Internet, do not need to take any action on Harmony for these vulnerabilities. The recommendations below apply only to the affected products.
What we recommend now. Until the fixed version is installed, we recommend that you:
- Keep affected products on your organisation-managed network, behind a firewall.
- Do not expose affected products directly to the Internet or to other untrusted networks.
- Apply the product-specific measure listed below where your clinical operations allow.
- Do not update, modify, or remove the PHP component on any Topcon system outside a Topcon-issued update. PHP is a required component, and changes made outside a validated update may make the software non-functional.
Fixed versions. Topcon will update the bundled PHP to a fixed version in the next version update of each affected product. Release dates are listed on the attachment. These dates reflect current plans and may change as validation is completed. We will notify you of any change, and we will notify you when each update is available, with deployment instructions.
Next update. Topcon is confirming several remaining items and will provide updated information as needed.
If you have questions, please contact your local Topcon Healthcare Support team or email our dedicated support address at [email protected]
Our Customer-Centric Culture
Topcon has a dedicated team of professionals worldwide who provide responsive phone support, in-house repair, field service and comprehensive training.
We are here to give you peace of mind on the technology you rely on so that you can focus on your patients and giving them the best care.
We appreciate the importance practice technology plays within the everyday running of your business, therefore our whole ethos is to do our best to get you up and running or provide you with the required tools to get you back on track as soon as is possible. That’s why we offer a variety of support options including Extended Warranty and Preventative Maintenance Contracts.
Managed Support Plans:
Please contact us for more information or a quotation.
Additionally:
For Marketing consumables: To order Patient Leaflets, Posters, and other consumables, please email [email protected]
For Product Training for your staff see our Training section or visit [email protected] for 250+ interactive e-learning courses and dynamic lectures, you'll just need to register for a free account.
Topcon's Standard Warranty
Click here to view our standard Warranty Statement (file opens in a new window)