Summary
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.
Impact
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| FactoryViews | vers:semver/>=1.0.0|<=1.12.1 | |
| MES4 | vers:all/* |
Vulnerabilities
Expand / Collapse allPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Mitigation
The xampp versions installed with older deployments of MES4 run PHP versions up to 7.3. These versions are out-of-support and no patches have been made available.
Users can apply the mitigation measures recommended by the PHP foundation:
- CVE-2026-109618: Set memory_limit=-1 in php.ini.
- CVE-2026-109619: Set "session.upload_progress.enabled=0" in php.ini. Additionally, the setting "MaxConnectionsPerChild 1" can be added to the end of httpd-xampp.conf. Note that this will have a significant negative impact on performance.
Users might also consider adding firewall rules to the Windows host system which restrict communication with httpd.exe from sources other than the HMI panels of manual workstations.
Remediation
Festo recommends updating FactoryViews 1.12.1 and earlier to FactoryViews 1.13.0.
For MES4 with xampp no fix is available. Please apply the mitigation measures.
Acknowledgments
Festo SE & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination and support with this publication
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 11/02/2026 13:00 | Initial Revision |