Vulnerability

Philips lists seven products in its PHP2Shell advisory and recommends removing PHP from NeuroQuant systems

MedDevice Cyber Staff · Oct 21 · 4 min read · Via Philips product security advisories

Philips published an advisory on October 21 for PHP2Shell, two critical flaws in PHP, and updated it on October 26. They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rated both 9.2 on CVSS v4.0. Philips says independent security researchers associate the flaws with potential remote code execution, and that it is monitoring developments. The advisory lists seven products and names no fixed version number for any of them.

Three listings carry footnote 1: Advanced Visualization Workstation V15 (product 881030), V16 (881004), and IntelliSpace Portal V12 (881050). Philips says the affected PHP component is used only by NeuroQuant, so systems without NeuroQuant are not affected. Where NeuroQuant runs, Philips recommends removing PHP from the server and says that does not change how NeuroQuant works. Customers are told to contact a Philips Service Engineer.

The other four listings get shorter treatment. Philips says it has implemented mitigations and additional monitoring for Ultrasound Fetview. It will contact affected INGENT Report (iReport) customers in Japan individually to discuss the appropriate response. Philips suspended the YaDockQuick service in Japan, applied a corrective patch, completed safety verification, and restored service on October 22. Philips Axon appears with no product number and no footnote. To the best of its knowledge, Philips says, the list is complete and products not listed should be considered not impacted.

Upstream, PHP shipped fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, in an out-of-band release it had announced for 14:00 UTC. Wiz Research, which named the flaws PHP2Shell and found them with Calif and OpenAI, reported them privately to the PHP security team on August 24. Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla for CVE-2026-109618, and against Drupal and WordPress for CVE-2026-109619. Technical details leaked before the planned disclosure.

Recorded Future reported on October 21 that Patchstack had seen multiple active exploitation incidents from hosting partners and that Cloudflare's CTO had reported early attacks. It said the extent of successful exploitation was not established. Because the flaws sit in PHP itself, Recorded Future notes, applications with secure code may still be vulnerable. PHP 8.1 and older no longer receive updates from the PHP project. Its security team did publish minimal source backports for 7.4, 8.0, and 8.1, and some distributions and LTS vendors supply backported fixes. A maker that bundles an old runtime in a web front end should confirm which of those it can use, or plan a runtime upgrade. For NeuroQuant systems, Philips advises removing PHP altogether.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Check whether the system runs NeuroQuant; Philips says systems without it are not affected. Where it does, Philips recommends removing PHP from the server and contacting a Philips Service Engineer, and it limits configuration and software changes to its own communicated procedures. For your own products, move PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Branches at 8.1 and older no longer get updates from the PHP project, so confirm a backported fix or plan an upgrade; Recorded Future says such builds should not be presumed unaffected.

Confirm whether NeuroQuant is installed. Philips says the affected PHP component is used only by NeuroQuant, so a system without it is not affected.
Remove PHP where NeuroQuant runs. Philips recommends removing PHP from the server and says NeuroQuant keeps working. Contact your Philips Service Engineer first, because Philips limits configuration and software changes to its own communicated procedures.
Upgrade PHP in your own products. Move to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, the versions PHP released on October 21.
Plan an exit from unsupported branches. PHP 8.1 and older no longer receive updates from the PHP project. Its security team published minimal source backports for 7.4, 8.0, and 8.1, and some distributions and LTS vendors supply fixes. Recorded Future says unsupported branches should not be presumed unaffected, so confirm which fix you can use or budget a runtime upgrade.
Treat the interim settings as a stopgap. The PHP advisory lists settings such as session.upload_progress.enabled=0, set in php.ini or the FPM pool rather than at runtime, and says such measures reduce exposure but do not make an installation safe.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Advanced Visualization Workspace

PID-31 PID-312 Off-the-shelf software

IntelliSpace Portal

PID-31 PID-312 Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2026-109618 and CVE-2026-109619, the PHP2Shell vulnerabilities?

CVE-2026-109618 and CVE-2026-109619 are critical memory-safety flaws in how PHP handles request memory, named PHP2Shell by Wiz Research. The PHP security team rated both 9.2 on CVSS v4.0. PHP released fixes on October 21, 2026 in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Which Philips products are listed in the PHP2Shell advisory?

Philips lists seven products in its PHP2Shell advisory, published October 21, 2026 and updated October 26: Advanced Visualization Workstation V15 and V16, IntelliSpace Portal V12, Philips Axon, Ultrasound Fetview, INGENT Report (iReport) in Japan, and YaDockQuick in Japan. Philips says that to the best of its knowledge the list is complete, and that products not listed should be considered not impacted.

How does Philips recommend mitigating PHP2Shell on NeuroQuant systems?

Philips says the affected PHP component is used only by NeuroQuant, so systems without NeuroQuant are not affected. On systems that run NeuroQuant, it recommends removing PHP from the server, which it says does not affect NeuroQuant's functionality, and tells customers to contact a Philips Service Engineer. The advisory names no fixed version number.

← Back to Vulnerabilities