Skip to content
OpenAdvisories
Critical 2 exploited CVEs VDE-2026-132 2 CVEs

WAGO: Multiple Devices affected by PHP2Shell

Published Nov 2, 2026 · Updated Nov 4, 2026 · Revision 2

Vendor: WAGO Product: CC100 Product: Edge Controller Product: PFC100 G2 Product: PFC200 G2 Product: PFC300 Product: TP600 Product: WP400

Summary

Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.

Details

Impact
Successful exploitation could allow an attacker to gain control over the affected PHP process through the web interface, potentially leading to unauthorized access, manipulation of application data, or disruption of device functionality.

Remediation
Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.

Mitigation
To mitigate these vulnerabilities, disable the device's web server through the security settings. This prevents the vulnerabilities from being exploited via the web interface until a security update or patch has been applied.

Vulnerabilities 2

  • Critical 9.2
    CVE-2026-109618 Exploited Public exploit Scanner template EPSS 100%

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026
  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit Scanner template EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026

Revision history

  1. #1.0.1

    Edited a typo in the product tree.

  2. #1.0.0

    Release version.

References