Vendors and CVEs › Vendors › Festo
Festo: industrial cyber security news and vulnerabilities
2 stories in Industrial Cyber Brief name Festo, 1 on CISA’s list of known exploited flaws, from Wednesday 21 October 2026 to Tuesday 3 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical Known exploited
Known-exploited PHP flaws hit Festo Didactic and WAGO products
Now listed by CISA as known exploited. The PHP bundled with Festo Didactic FactoryViews and MES4 (with xampp) has two critical flaws, CVE-2026-109618 and CVE-2026-109619 ('PHP2Shell').
Medium
OpenSSL flaws affect Festo AX OS in the CEPE product
Festo AX OS versions 25.0.1.46 and 25.9.2.4, used by the Festo CEPE and based on PLCnext, are affected by two OpenSSL flaws. Attacks involve crafted firmware, key files or signed objects.