PHP Vulnerabilities Response Center

Check here for the latest information on the PHP vulnerability by PTC product (CVE-2026-109618 and CVE-2026-109619)

.jumbotron-noscript-cta { display: inline-block !important; visibility: inherit !important; } .jumbotron-noscript-cta + .jumbotron-noscript-cta { margin-left: 1rem; } .jumbotron-noscript-countdown { display: block !important; visibility: inherit !important; margin-top: 1rem; } .jumbotron-noscript-countdown-title, .jumbotron-noscript-countdown-time { display: block; margin: 0; }

PTC's remediation strategy

Two critical vulnerabilities affecting PHP, collectively referred to as PHP2Shell, have been publicly disclosed. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated attacker to execute code remotely in affected PHP environments without user interaction. Other demonstrated impacts include process crashes, arbitrary file reads, and disclosure of server memory.

PTC has assessed the potential impact of these vulnerabilities across our products and environments. We will provide additional information through the Trust Center as appropriate.

Organizations using PHP should assess their environments for exposure and update affected PHP versions as soon as possible.

Recommended remediation by core product

If you need to contact PTC, please go to: www.ptc.com/support.

Arena

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Arbortext

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Arbortext Content Delivery

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Arbortext IsoDraw

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

CADDS5

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Codebeamer

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Direct

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Elements Direct

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Generative Design

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Layout

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Parametric

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Schematics

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Creo Simulate

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Empower

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

iWarranty

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Kepware

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Mathcad

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

MKS Implementer

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

MKS Toolkit

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

MOVE

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Onshape

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

PTC Illustrate

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

PTC Jetstream

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

PTC Modeler

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

PTC Orbit

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Pure Variants

Has updated PHP to latest non-vulnerable version.

Updated October 23, 2026 at 10:00 a.m.

Service Knowledge Diagnostics (SKD)

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

ServiceMax

Has updated PHP to latest non-vulnerable version.

Updated October 23, 2026 at 10:00 a.m.

ServiceMax Core

Has updated PHP to latest non-vulnerable version.

Updated October 23, 2026 at 10:00 a.m.

ServiceMax FieldFX

Has updated PHP to latest non-vulnerable version.

Updated October 23, 2026 at 10:00 a.m.

Servigistics

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

ThingWorx Analytics

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

ThingWorx Platform

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Chalk

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Engine SDK

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Engine Server

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Expert Capture

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Instruct

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Vuforia Studio

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Webship

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Asset Library

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Navigate

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill PLM and FlexPLM

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Process Director

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Product Analytics

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Requirements Connector

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill Risk and Reliability (Formerly Windchill Quality Solutions)

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

Windchill RV&S

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.

Updated October 23, 2026 at 10:00 a.m.

PTC Cloud

In response to the PHP vulnerability disclosure, PTC Cloud has applied all formally recommended actions to protect against CVE-2026-109618 and CVE-2026-109619 as part of our Cloud offerings. Additionally, environments are scanned to ensure PHP executables and libraries present are updated or removed.

If you have any questions or concerns, please send your inquires to [email protected] and we will respond to you as soon as possible.

PTC Core Products

Servigistics

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability – see https://www.ptc.com/en/support/article/CS482911
Updated October 23, 2026 at 10:00 a.m.

ThingWorx

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability – see https://www.ptc.com/en/support/article/CS482951
Updated October 23, 2026 at 10:00 a.m.

Windchill PLM and FlexPLM

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability – see https://www.ptc.com/en/support/article/CS482911
Updated October 23, 2026 at 10:00 a.m.

PTC Cloud Third-Party Products/Tools

PLM – Ping Federate, Cognos, Solr, APE, AEM

Not vulnerable to PHP2Shell CVE-2026-109618 and CVE-2026-109619 vulnerability.
Updated October 23, 2026 at 10:00 a.m.

How can we help you?

icon of gear with wrench inside

Support Portal

chat bubbles icon

Contact an Expert

person with globe icon

Join the PTC Community

PTC Store

icon of laptop with checkmark rising out

Training and Skills

Training Support

Training Support