Information regarding the PHP security vulnerability (CVE-2026-109618 / CVE-2026-109619)

23 October 2026

On 21 October 2026, two critical security vulnerabilities in the PHP programming language (known as ‘PHP2Shell’) were disclosed. Several customers have asked us whether our products are affected.

Following our investigation, no devices from prophysics AG nor any associated software are affected by these security vulnerabilities. Our devices do not use PHP and do not have a web interface through which the device or data can be accessed via a web browser. This means there is no risk to the operation of the devices when used in research, clinics and hospitals.

The security vulnerability on our website’s web server has been patched.

If you have any questions, please contact luescher@prophysics.ch or schweizer@prophysics.ch.