CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 00:32.

Filters

1 active

Reset filters

Search: FSA-202603

Vendor

Protocol

Sector

Severity

Source

1 advisories found

FSA-202603

Two critical PHP vulnerabilities in several Festo Didactic products

Festo — FactoryViews

Festo PSIRTcritical

Published

2 November 2026

Last update

5 November 2026

Linked CVEs

CVE-2026-109618 CVE-2026-109619

Affected sectors

Risk evaluation

Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vulnerabilities allow an attacker to remotely execute code on the FactoryViews or xampp host system.

Mitigation summary

Install patch 1.12.2 through the "Versions" page of the FactoryViews control panel on version 1.12.0 or 1.12.1. Versions of FactoryViews prior to 1.12 must first be updated to 1.12 available for download here: https://www.festo.com/de/de/support-portal-specific?query=factoryviews&groupId=4&productName=factoryviews&documentId=659952

Revision history (2)

Initial publication — 2 November 2026
Initial Revision
Update A — 5 November 2026
Adjusted information about vendor fix for FactoryViews

Official source: Festo PSIRT