PHP2Shell Security Advisory

2026 October
CVE-2026-109618, CVE-2026-109619 

Last updated: 2026 October 29th

Background
Leica Biosystems (LBS) has been notified of two security vulnerabilities affecting PHP from 5.4 through 8.5.11: CVE-2026-109618, CVE-2026-109619. Exploitation of these vulnerabilities may allow an unauthenticated network attacker to execute code with the privileges of the affected webserver process when specific runtime conditions are met.

Leica Biosystems has assessed its products and identified those that contain affected versions of PHP. The impact and recommended actions vary by product and configuration, as described in the table below. Leica Biosystems is not aware of any exploitation of these vulnerabilities affecting Leica Biosystems products.

Leica Biosystems recommends that customers of affected products review the product-specific guidance below, assess their network configuration, and implement the recommended mitigations where applicable.

Product Status

Product Status Regarding PHP Vulnerability Recommendations and Comments
Aperio AT2, Aperio AT2 DX Not Vulnerable PHP not present.
Aperio CS2 Not Vulnerable PHP not present.
Aperio eSlide Manager Potentially Vulnerable

The patch released by The PHP Group to address the PHP vulnerability has been successfully tested with Aperio eSlide Manager versions: 12.5.1, 12.6.0, and 12.6.1. Customers should contact their local Leica Biosystems Support team for assistance applying the patch. A permanent fix is planned for version 12.6.2.

  • Customers using versions 12.5.1, 12.6.0, or 12.6.1 should contact their local Leica Biosystems Support team for assistance with the patch installation.
  • Customers on versions prior to 12.5.1 are directed to contact support for assistance upgrading to a currently supported version.

Customers should not independently update PHP, or other eSlide Manager components, as this may affect system functionality or future Leica Biosystems updates.

Until the PHP patch has been applied or the software has been upgraded to a version containing the permanent fix, Leica Biosystems recommends that customers take the following precautions:

  • Ensure Aperio eSlide Manager is not directly accessible from the Internet. If it is, prevent access immediately.
  • Review network exposure of eSlide Manager, and ensure that only required systems have access. Consider the use of networking controls such as firewalls, reverse proxies, network segmentation, monitoring for unusual network traffic to prevent access from untrusted systems.
  • Warning: Altering PHP or any other configuration in eSM may result in reduced functionality and prevent future updates.
  • If you are unable to adequately compensate with network controls, then eSlide Manager should be disconnected from the network until a permanent solution is available.
Aperio GT 450 (RUO) (23GT450), Aperio GT 450 DX (23GT450DX), Aperio GT 450 DX (23GT450DXIVD), Aperio GT 450 Standalone Not Vulnerable PHP not present.
Aperio ImageScope, Aperio ImageScope DX Not Vulnerable PHP not present.
Aperio LV1 Not Vulnerable PHP not present.
Aperio Scanner Administration Manager (SAM for RUO), Aperio GT 450 SAM DX Software (23GT450DXSAMSW) Aperio GT 450 SAM DX Software (23SAMSWDXIVD) Aperio Scanner Administration Manager DX (SAM for Standalone) Not Vulnerable PHP not present.
Aperio VERSA Not Vulnerable PHP not present.
Aperio WebViewer, Aperio WebViewer DX (23WVDXROW) Not Vulnerable PHP not present.
BOND-ADVANCE, BOND Controller Not Vulnerable PHP not present.
BOND-III Not Vulnerable PHP not present.
BOND-MAX Not Vulnerable PHP not present.
BOND RX, BOND RXm Not Vulnerable PHP not present.
CEREBRO Not Vulnerable PHP not present.
CytoVision Not Vulnerable PHP not present.
HistoCore Arcadia C Not Vulnerable PHP not present.
HistoCore Arcadia H Not Vulnerable PHP not present.
HistoCore PEARL Not Vulnerable PHP not present.
HistoCore PEGASUS (PLUS) Not Vulnerable PHP not present.
HistoCore PELORIS 3 Not Vulnerable PHP not present.
HistoCore SPECTRA CV Not Vulnerable PHP not present.
HistoCore SPECTRA ST Not Vulnerable PHP not present.
HistoCore SPRING ST Not Vulnerable PHP not present.
Leica ASP200 (S), Leica ASP300 (S) Not Vulnerable PHP not present.
Leica ASP6025 (S) Not Vulnerable PHP not present.
Leica CV5030 Not Vulnerable PHP not present.
Leica IP C Not Vulnerable PHP not present.
Leica IP S Not Vulnerable PHP not present.
Leica ST4020 Not Vulnerable PHP not present.
Leica ST5010 Not Vulnerable PHP not present.
Leica ST5020 Not Vulnerable PHP not present.
Leica TP1020 Not Vulnerable PHP not present.
PELORIS, PELORIS II Not Vulnerable PHP not present.
PathDX Not Vulnerable PHP not present.
Remote Service Software Potentially Vulnerable Remote Services Software uses BeyondTrust Remote Support which was impacted by PHP2Shell. Leica Biosystems completed patching the cloud infrastructure at approximately 2026 October 22, 12:00, UTC. No evidence of compromise was detected in Remote Service Software infrastructure. No further action is required by customers to remain secure.