Summary
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.
Details
Mitigation
The xampp versions installed with older deployments of MES4 run PHP versions up to 7.3. These versions are out-of-support and no patches have been made available.
Users can apply the mitigation measures recommended by the PHP foundation:
- CVE-2026-109618: Set memory_limit=-1 in php.ini.
- CVE-2026-109619: Set "session.upload_progress.enabled=0" in php.ini. Additionally, the setting "MaxConnectionsPerChild 1" can be added to the end of httpd-xampp.conf. Note that this will have a significant negative impact on performance.
Users might also consider adding firewall rules to the Windows host system which restrict communication with httpd.exe from sources other than the HMI panels of manual workstations.
Remediation
Festo recommends updating FactoryViews to version 1.12.2 through the "Versions" page of the FactoryViews control panel. Versions of FactoryViews prior to 1.12 must first be updated to 1.12 available for download here: https://www.festo.com/de/de/support-portal-specific?query=factoryviews&groupId=4&productName=factoryviews&documentId=659952
For MES4 with xampp no fix is available. Please apply the mitigation measures.
Vulnerabilities 2
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026
Revision history
-
#2.0.0
Adjusted information about vendor fix for FactoryViews
-
#1.0.0
Initial Revision
References
-
CERT@VDE Advisory
https://certvde.com/en/advisories/vendor/festo/
-
For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://www.festo.com/psirt
-
FSA-202603: Two critical PHP vulnerabilities in several Festo Didactic products - HTML
https://certvde.com/en/advisories/VDE-2026-139