Act today Critical Known exploited Patch available
Known-exploited PHP flaws hit Festo Didactic and WAGO products
CERT@VDE advisoriesFesto Didactic, FactoryViews, MES4 · manufacturingCVE-2026-109618, CVE-2026-109619
What happened. Now listed by CISA as known exploited. The PHP bundled with Festo Didactic FactoryViews and MES4 (with xampp) has two critical flaws, CVE-2026-109618 and CVE-2026-109619 ('PHP2Shell'). Attackers can run code remotely on the host.
Who is affected. Users of Festo Didactic FactoryViews and MES4 deployed with xampp, and WAGO devices named in the linked advisory. The source gives no version numbers.
What to do. Check whether you run FactoryViews or MES4 with xampp, or the affected WAGO devices, and apply the vendor fixes from the advisories.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L3
- L2
Why: FactoryViews and MES4 are manufacturing execution and visualisation software on site servers and workstations, which sit at L3 and L2.
- Are you exposed?
Search the asset inventory for Festo Didactic FactoryViews, MES4 and xampp installs, and for the WAGO devices listed in the advisory, and check which are reachable over the network.
- If you cannot fix it yet
- Restrict access to the Apache web server on FactoryViews and xampp hosts to known engineering and operator hosts only.
- Block inbound web traffic from the corporate network and internet to these hosts at the firewall.
- Run the web service under a low-privilege account where the vendor allows it.
- Watch for
- Unexpected child processes or shell commands started by the Apache or PHP process on FactoryViews or xampp hosts.
- Web requests to the PHP server from unfamiliar addresses, followed by new files in web directories.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.