Description:
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host
system.
A successful attack on a vulnerable PHP installation allows the attacker to remotely execute malicious code on the FactoryViews or xampp host system with the privileges of the user account running the server application.