Dear Customer, on October 21, 2026, the PHP project disclosed and fixed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together referred to as "PHP2Shell." PHP is an open-source scripting language commonly used to build web applications. Under certain memory conditions, these issues could allow a remote attacker to run arbitrary code on a system using an affected version of PHP. PHP is not used and has not been used in our software products, including PremiumHMI, FactoryTalk Optix, UBIQUITY / FactoryTalk Remote Access and System Manager. PHP is also not used in our embedded devices based on closed operating systems, including WinCE-based products such as HMI30/HMI40, and Linux-based products such as OptixPanel, OptixEdge and RK2x Routers. Therefore, the PHP component affected by these vulnerabilities is not present in these products.
Rockwell Automation has also published a specific security advisory for these vulnerabilities, SD1802. As of the latest update, no Rockwell Automation products have been confirmed as affected.
You can find the advisory here: SD1802 – PHP2Shell Security Advisory
More generally, security information related to Rockwell Automation and ASEM products is always published through the Rockwell Automation Security Advisory Portal: Rockwell Automation Security Advisories
