PHP2Shell - Remote Code Execution Vulnerabilities in PHP CVE-2026-109618 and CVE-2026-109619

The security of our products is a top priority. As your industrial automation supplier, Rockwell Automation is issuing this notice to keep customers informed about publicly reported vulnerabilities affecting a widely used third-party component. Rockwell Automation has completed its assessment of the products reviewed for CVE-2026-109618 and CVE-2026-109619 and has not identified any of those products as affected. Should new information become available, Rockwell Automation will update this advisory accordingly.

Overview

On October 21, 2026, the PHP project disclosed and fixed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together referred to as "PHP2Shell." PHP is an open-source scripting language commonly used to build web applications. Under certain memory conditions, these issues could allow a remote attacker to run arbitrary code on a system using an affected version of PHP.  

Rockwell Automation Product Status

As of 11/3/2026, Rockwell Automation has completed its assessment and has not identified any products affected by CVE-2026-109618 or CVE-2026-109619. Should new information become available, Rockwell Automation will update this advisory accordingly.

Vulnerability Details (Third-Party Component: PHP)

Recommended Actions 
 
For upgraded guidance and available mitigations, customers who independently manage PHP installations should refer to the PHP security advisories and upgrade guidance https://www.php.net/archive/2026.php#2026-10-21-5. 
 
As a general security practice, customers should minimize network exposure of control system devices and systems, avoid exposure to public internet, and place them behind firewalls. When remote access is required, use secure methods such as virtual private networks (VPNs) that are consistently updated. For additional guidance, refer to our security best practices. 

Revision History

Glossary:

• PHP: An open-source scripting language widely used to build and run web applications and web interfaces. 

• Remote Code Execution (RCE): A condition that allows an attacker to run commands or code on a target system from across a network. 

• Use-After-Free: A memory error where a program continues to use memory after it has been released, which can lead to crashes or code execution. 

• Out-of-Memory Handling: How software responds when it cannot get enough memory to finish a task. 

Get Up-to-Date Product Security Information

Visit the Rockwell Automation security advisories on our Trust Center page to: 

• Subscribe to product security alerts 

• Review the current list of Rockwell Automation security advisories 

• Report a possible security issue in a Rockwell Automation product 

• Learn more about the vulnerability policy

Support

If you have any questions regarding Rockwell Automation products in connection with this notice, contact TechConnect for help. More information can be found at Contact Us | Rockwell Automation | US.

If you have any questions regarding this notice, please contact PSIRT 
Email: rasecure@ra.rockwell.com

Legal Disclaimer

ROCKWELL AUTOMATION DOES NOT WARRANT THE COMPLETENESS, TIMELINESS OR ACCURACY OF ANY OF THE DATA CONTAINED IN THIS NOTICEAND MAY MAKE CHANGES THERETO AT ANY TIME IN ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS "AS IS." IN NO EVENT SHALL ROCKWELL BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PROFIT LOSS OR DAMAGE, EVEN IF ROCKWELL AUTOMATION HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ROCKWELL AUTOMATION DISCLAIMS ALL WARRANTIES WHETHER EXPRESS OR IMPLIED IN RESPECT OF THE INFORMATION (INCLUDING SOFTWARE) PROVIDED HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, AND NON-INFRINGEMENT. Note that certain jurisdictions do not countenance the exclusion of implied warranties; thus, this disclaimer may not apply to you.