PHP2Shell Security Advisory

2026 October
CVE-2026-109618, CVE-2026-109619

Background
Leica Biosystems (LBS) has been notified of two security vulnerabilities affecting PHP from 5.4 through 8.5.11: CVE-2026-109618, CVE-2026-109619. Exploitation of these vulnerabilities may allow an unauthenticated network attacker to execute code with the privileges of the affected webserver process when specific runtime conditions are met.

Leica Biosystems has assessed its products and identified those that contain affected versions of PHP. The impact and recommended actions vary by product and configuration, as described in the table below. Leica Biosystems is not aware of any exploitation of these vulnerabilities affecting Leica Biosystems products.

Leica Biosystems recommends that customers of affected products review the product-specific guidance below, assess their network configuration, and implement the recommended mitigations where applicable.

This security advisory will be updated as new information becomes available.

Product Status

Product Status Regarding PHP Vulnerability Recommendations and Comments
Aperio AT2, Aperio AT2 DX Not Vulnerable PHP not present.
Aperio CS2 Not Vulnerable PHP not present.
Aperio eSlide Manager Potentially Vulnerable

PHP is a component of all versions of Aperio eSlide Manager.

Leica Biosystems is investigating and testing the patches and mitigations recommended by the PHP Governance Group.

Until a solution is available Leica Biosystems, customers should:

  • Ensure Aperio eSlide Manager is not directly accessible from the Internet. If it is, prevent access immediately.
  • Review network exposure of eSlide Manager, and ensure that only required systems have access. Consider the use of networking controls such as firewalls, reverse proxies, network segmentation, monitoring for unusual network traffic to prevent access from untrusted systems.
  • Warning: Altering PHP or any other configuration in eSM may result in reduced functionality and prevent future updates.
  • If you are unable to adequately compensate with network controls, then eSlide Manager should be disconnected from the network until a permanent solution is available.
Aperio GT 450 (RUO) (23GT450), Aperio GT 450 DX (23GT450DX), Aperio GT 450 DX (23GT450DXIVD), Aperio GT 450 Standalone Not Vulnerable PHP not present.
Aperio ImageScope, Aperio ImageScope DX Not Vulnerable PHP not present.
Aperio LV1 Not Vulnerable PHP not present.
Aperio Scanner Administration Manager (SAM for RUO), Aperio GT 450 SAM DX Software (23GT450DXSAMSW), Aperio GT 450 SAM DX Software (23SAMSWDXIVD), Aperio Scanner Administration Manager DX (SAM for Standalone) Not Vulnerable PHP not present.
Aperio VERSA Not Vulnerable PHP not present.
Aperio WebViewer, Aperio WebViewer DX (23WVDXROW) Not Vulnerable PHP not present.
BOND-ADVANCE, BOND Controller Not Vulnerable PHP not present.
BOND-III Not Vulnerable PHP not present.
BOND-MAX Not Vulnerable PHP not present.
BOND RX, BOND RXm Not Vulnerable PHP not present.
CEREBRO Not Vulnerable PHP not present.
CytoVision Not Vulnerable PHP not present.
HistoCore Arcadia C Not Vulnerable PHP not present.
HistoCore Arcadia H Not Vulnerable PHP not present.
HistoCore PEARL Not Vulnerable PHP not present.
HistoCore PEGASUS (PLUS) Not Vulnerable PHP not present.
HistoCore PELORIS 3 Not Vulnerable PHP not present.
HistoCore SPECTRA CV Not Vulnerable PHP not present.
HistoCore SPECTRA ST Not Vulnerable PHP not present.
HistoCore SPRING ST Not Vulnerable PHP not present.
Leica ASP200 (S), Leica ASP300 (S) Not Vulnerable PHP not present.
Leica ASP6025 (S) Not Vulnerable PHP not present.
Leica CV5030 Not Vulnerable PHP not present.
Leica IP C Not Vulnerable PHP not present.
Leica IP S Not Vulnerable PHP not present.
Leica ST4020 Not Vulnerable PHP not present.
Leica ST5010 Not Vulnerable PHP not present.
Leica ST5020 Not Vulnerable PHP not present.
Leica TP1020 Not Vulnerable PHP not present.
PELORIS, PELORIS II Not Vulnerable PHP not present.
PathDX Not Vulnerable PHP not present.
Remote Service Software Potentially Vulnerable Remote Services Software uses BeyondTrust Remote Support which was impacted by PHP2Shell. Leica Biosystems completed patching the cloud infrastructure at approximately 2026 October 22, 12:00, UTC. No evidence of compromise was detected in Remote Service Software infrastructure. No further action is required by customers to remain secure.

As this is an active and evolving situation, the advice provided is subject to change as new information comes to light. Check the Leica Biosystems product security advisories page for updates. https://www.leicabiosystems.com/us/about/product-security-advisories/