FAQ: Are products in the zenon product family affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
Quick Information:
- On October 21, 2026, two critical vulnerabilities in PHP were disclosed, commonly referred to as "PHP2Shell".
- Both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have a CVSS v4.0 score of 9.2 and could allow unauthenticated remote code execution on vulnerable PHP installations.
- The zenon Software Platform is not affected by these vulnerabilities.
As a software manufacturer, COPA-DATA takes security and the protection of its customers and partners very seriously.
This FAQ provides information about the recently disclosed PHP vulnerabilities and clarifies their impact on the zenon Software Platform.
What is the vulnerability called "PHP2Shell"?
On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities affecting PHP, a widely used server-side scripting language for web applications.
The vulnerabilities are identified as:
- CVE-2026-109618 – Remote Code Execution via Out-of-Memory Corruption: A flaw in PHP's handling of out-of-memory conditions can cause internal request data to remain partially initialized. Subsequent cleanup operations may process this invalid data, potentially allowing an attacker to execute arbitrary code.
- CVE-2026-109619 – Remote Code Execution via Stale Global State: A use-after-free vulnerability where request-specific internal state may remain accessible after its associated memory has been released. Under certain conditions, this can allow attackers to execute arbitrary code or access sensitive process memory.
Both vulnerabilities have been assigned a CVSS v4.0 score of 9.2 (Critical).
Successful exploitation could allow an unauthenticated remote attacker to execute malicious code within the security context of the affected PHP process.
Key properties
- Both vulnerabilities have been assigned a CVSS v4.0 score of 9.2 (Critical).
- Successful exploitation could allow an unauthenticated remote attacker to execute malicious code within the security context of the affected PHP process.
- The vulnerabilities affect PHP installations serving web requests, including environments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
How is the zenon Software Platform deployment impacted by "PHP2Shell"?
Based on the current investigations, the zenon Software Platform is not affected by CVE-2026-109618 or CVE-2026-109619.
- The reported vulnerabilities concern the PHP runtime and do not constitute a vulnerability in the zenon Software Platform itself. Consequently, no vulnerability-specific update of the zenon Software Platform is required to address these PHP vulnerabilities.
However, Asset Owners and System Integrators should independently assess any third-party PHP-based applications, web services, or infrastructure components that may be deployed alongside the zenon Software Platform.
Recommended Mitigations
Although the zenon Software Platform is not affected, COPA-DATA recommends that Asset Owners and System Integrators follow the security recommendations published by the PHP development team for independently managed PHP installations.
Recommended actions include:
- Identify affected PHP installations: Check whether PHP is used by additional applications, web servers, or third-party components within the infrastructure.
- Apply security updates: Update affected PHP installations to the fixed versions (PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as applicable). Older, unsupported PHP versions should be upgraded or addressed through supported vendor security updates.
- Review network exposure: Prioritize internet-facing PHP services and restrict access to vulnerable systems until security updates have been applied.
The PHP development team emphasizes that security updates are the only complete remediation for these vulnerabilities.
Initial release date: 22/10/26
Publishing Authority: COPA-DATA PSIRT
References
The content of these links is not managed by Ing. Punzenberger COPA-DATA GmbH.