Vendors and CVEs › CVEs › CVE-2026-109619
CVE-2026-109619: what it is, who is affected and what to do
ABB reports public vulnerabilities in third-party components (PHP and NTFS-3G) in the IPEC iSM Local Server. An attacker could insert and run arbitrary code. ABB has had no reports of active exploitation. Highest CVSS score stated: 9.8.
- Scores and exploitation. The stories below cover this flaw together with others, so the Brief does not give its scores here: check the records below.
- Records. CVE-2026-109619 on the National Vulnerability Database · CISA’s known exploited catalog
The stories
Critical Known exploited
ABB IPEC iSM Local Server has flaws in PHP and NTFS-3G
ABB reports public vulnerabilities in third-party components (PHP and NTFS-3G) in the IPEC iSM Local Server. An attacker could insert and run arbitrary code. ABB has had no reports of active exploitation.
Critical Known exploited
Known-exploited PHP flaws hit Festo Didactic and WAGO products
Now listed by CISA as known exploited. The PHP bundled with Festo Didactic FactoryViews and MES4 (with xampp) has two critical flaws, CVE-2026-109618 and CVE-2026-109619 ('PHP2Shell').
Critical Known exploited
ABB gateway and NAM products hit by PHP flaws now listed as exploited
New: CISA now lists these PHP flaws as known exploited. ABB says an attacker could insert and run arbitrary code on affected products. The highest stated CVSS score is 9.8. Covers CVE-2026-109618 and CVE-2026-109619.
Critical Known exploited
METTLER TOLEDO Octo Image Server also hit by PHP 'PHP2Shell' flaws
New: METTLER TOLEDO's OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The advisory strongly recommends upgrading PHP to version 8.2.35.
Critical Known exploited
PHP 'php2shell' flaws now listed as known exploited; Siemens still assessing products
CISA now lists the two php2shell flaws (CVE-2026-109618 and CVE-2026-109619) as known exploited. They let an unauthenticated attacker run code remotely in the PHP runtime.
High
Siemens reviews which products are hit by PHP 'php2shell' flaws
On 21 October 2026 the PHP project and researchers disclosed two unauthenticated remote code execution flaws in the PHP runtime, known as "php2shell" (CVE-2026-109618 and CVE-2026-109619).