Security Information: Potential Impact of Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Last Updated: October 23, 2026

Vulnerability Overview

On October 21, 2026, the PHP Group published a security advisory regarding multiple vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619).
Regarding potential impact to Yokogawa products, please check below.

 

Potential impact on Yokogawa Products

The information confirmed as of the date of this notice is provided below.
[Not Affected]
・FA-M3

Yokogawa is continuing to assess the potential impact on other Yokogawa products.
If any affected products are identified, Yokogawa will provide detail information in Yokogawa Security Advisory Report (YSAR) as soon as countermeasures become available.

Yokogawa Security Advisory Report List
https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/ 

The Yokogawa Group Vulnerability Handling Policy
https://www.yokogawa.com/solutions/products-and-services/lifecycle-services/safety-and-security/announcements/vulpolicy/

To help reduce cybersecurity risks, Yokogawa recommends implementing security measures for the overall systems, not only for the vulnerabilities described in this notice.
*Examples of security measures include applying patches, antivirus protection, application whitelisting, system hardening, backups, firewalls, and network segmentation.

 

References

• The PHP Group
  Security advisory: Critical remote code execution vulnerabilities, update now
  https://www.php.net/archive/2026.php#2026-10-21-5
• CISA
  Critical Vulnerabilities in PHP Require Immediate Patching | CISA