Vendors and CVEs › Vendors › PHP
PHP: industrial cyber security news and vulnerabilities
3 stories in Industrial Cyber Brief name PHP, 2 on CISA’s list of known exploited flaws, from Saturday 24 October 2026 to Wednesday 28 October 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical Known exploited
METTLER TOLEDO Octo Image Server also hit by PHP 'PHP2Shell' flaws
New: METTLER TOLEDO's OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The advisory strongly recommends upgrading PHP to version 8.2.35.
Critical Known exploited
PHP 'php2shell' flaws now listed as known exploited; Siemens still assessing products
CISA now lists the two php2shell flaws (CVE-2026-109618 and CVE-2026-109619) as known exploited. They let an unauthenticated attacker run code remotely in the PHP runtime.
High
Siemens reviews which products are hit by PHP 'php2shell' flaws
On 21 October 2026 the PHP project and researchers disclosed two unauthenticated remote code execution flaws in the PHP runtime, known as "php2shell" (CVE-2026-109618 and CVE-2026-109619).