Summary
OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.
Impact
A vulnerable PHP component in OCTO Image Server may allow remote code execution. An attacker could execute arbitrary code on the system hosting OCTO Image Server.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| OCTO Image Server | PHP 8.2.0 to 8.2.34 |
Vulnerabilities
Expand / Collapse allPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Remediation
Octo Image Server is typically installed on computers within a customer's internal network and is not intended to be directly exposed to the public internet.
While the risk to installations is low, we recommend updating the PHP package to version 8.2.35 to eliminate any potential exposure and maintain current cybersecurity best practices.
Acknowledgments
Mettler-Toledo GmbH thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 10/28/2026 23:00 | Initial revision |