Act today Critical Known exploited Patch available
METTLER TOLEDO Octo Image Server also hit by PHP 'PHP2Shell' flaws
CERT@VDE advisoriesMETTLER TOLEDO, PHPCVE-2026-109618, CVE-2026-109619
What happened. New: METTLER TOLEDO's OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The advisory strongly recommends upgrading PHP to version 8.2.35.
Who is affected. Users of METTLER TOLEDO OCTO Image Server, which ships a vulnerable PHP version. The source gives no affected version numbers for the server itself.
What to do. Upgrade PHP in OCTO Image Server to version 8.2.35, as the vendor advisory recommends.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
Why: The source describes an image server running PHP, which suggests a site-level server in operations (L3). The report does not state its exact placement.
- Are you exposed?
Check the asset inventory for OCTO Image Server installs and confirm which PHP version each one runs.
- If you cannot fix it yet
- Restrict network access to the OCTO Image Server web service to known client hosts only.
- Block internet access to the server and place it behind a firewall until PHP is upgraded.
- Watch for
- Unexpected web requests to the server's PHP pages, or new files appearing in its web directories.
- Web server processes starting shells or unfamiliar child processes on the OCTO Image Server host.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on PHP CVE-2026-109618 CVE-2026-109619