Rockwell PHP2Shell - Remote Code Execution Vulnerabilities in PHP CVE-2026-109618 and CVE-2026-109619
Vendor statement: still investigating. Rockwell Automation has not confirmed any of its products as affected by CVE-2026-109618 and CVE-2026-109619 and is still reviewing which products include the affected component. OTPulse rechecks this advisory daily and will rank it once Rockwell Automation names affected products.
Read the Rockwell Automation statementTwo critical vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, referred to as "PHP2Shell"—allow remote code execution through a use-after-free condition during out-of-memory handling. A later request may read or act on memory left over from an earlier request. Rockwell Automation is reviewing its product portfolio to determine whether any products include or rely on an affected version of PHP. As of this advisory, no Rockwell Automation products have been confirmed as affected.
/api/v1/advisories/3c8de492-3aec-41c9-86e5-6bbb0627268fGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.