PHP2Shell - Remote Code Execution Vulnerabilities in PHP CVE-2026-109618 and CVE-2026-109619

The security of our products is a top priority. As your industrial automation supplier, Rockwell Automation is issuing this notice to keep customers informed about publicly reported vulnerabilities affecting a widely used third-party component. We are currently assessing any potential impact to Rockwell products and systems and will provide updates as additional information becomes available 

Overview

On October 21, 2026, the PHP project disclosed and fixed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together referred to as "PHP2Shell." PHP is an open-source scripting language commonly used to build web applications. Under certain memory conditions, these issues could allow a remote attacker to run arbitrary code on a system using an affected version of PHP.  

Rockwell Automation Product Status

Rockwell Automation is reviewing its product portfolio to determine whether any products include or rely on an affected version of PHP. As of the date of this notice, no Rockwell Automation products have been confirmed as affected. If an affected product is identified, Rockwell Automation will update this advisory with relevant information. 

Vulnerability Details (Third-Party Component: PHP)

Recommended Actions 
 
For upgraded guidance and available mitigations, customers who independently manage PHP installations should refer to the PHP security advisories and upgrade guidance https://www.php.net/archive/2026.php#2026-10-21-5. 
 
As a general security practice, customers should minimize network exposure of control system devices and systems, avoid exposure to public internet, and place them behind firewalls. When remote access is required, use secure methods such as virtual private networks (VPNs) that are consistently updated. For additional guidance, refer to our security best practices. 

Revision History

Glossary:

• PHP: An open-source scripting language widely used to build and run web applications and web interfaces. 

• Remote Code Execution (RCE): A condition that allows an attacker to run commands or code on a target system from across a network. 

• Use-After-Free: A memory error where a program continues to use memory after it has been released, which can lead to crashes or code execution. 

• Out-of-Memory Handling: How software responds when it cannot get enough memory to finish a task. 

Get Up-to-Date Product Security Information

Visit the Rockwell Automation security advisories on our Trust Center page to: 

• Subscribe to product security alerts 

• Review the current list of Rockwell Automation security advisories 

• Report a possible security issue in a Rockwell Automation product 

• Learn more about the vulnerability policy

Support

If you have any questions regarding Rockwell Automation products in connection with this notice, contact TechConnect for help. More information can be found at Contact Us | Rockwell Automation | US.

If you have any questions regarding this notice, please contact PSIRT 
Email: rasecure@ra.rockwell.com

Legal Disclaimer

ROCKWELL AUTOMATION DOES NOT WARRANT THE COMPLETENESS, TIMELINESS OR ACCURACY OF ANY OF THE DATA CONTAINED IN THIS NOTICEAND MAY MAKE CHANGES THERETO AT ANY TIME IN ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS "AS IS." IN NO EVENT SHALL ROCKWELL BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PROFIT LOSS OR DAMAGE, EVEN IF ROCKWELL AUTOMATION HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ROCKWELL AUTOMATION DISCLAIMS ALL WARRANTIES WHETHER EXPRESS OR IMPLIED IN RESPECT OF THE INFORMATION (INCLUDING SOFTWARE) PROVIDED HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, AND NON-INFRINGEMENT. Note that certain jurisdictions do not countenance the exclusion of implied warranties; thus, this disclaimer may not apply to you.