Product Security News
Stay informed about the latest METTLER TOLEDO product security updates, advisories, and cybersecurity initiatives.
Cybersecurity threats such as data breaches, ransomware attacks, and unauthorized access continue to affect organizations across industries, making product security more important than ever. At METTLER TOLEDO, security is a core component of our product development and lifecycle management approach. We are committed to delivering high-quality solutions that help protect systems, data, and operations through a comprehensive product security strategy.
Our security approach spans the entire measurement and process chain, from precision sensors and analytical instruments to secure industrial gateways, control systems, and enterprise data management platforms. Through continuous monitoring, security enhancements, vulnerability management, and industry best practices, we work to address emerging cyber risks and support the security needs of our customers.
This Product Security News page provides the latest security updates, advisories, announcements, and insights from METTLER TOLEDO. Visit regularly to stay informed about product security developments, learn about newly identified vulnerabilities and mitigations, and gain visibility into our ongoing efforts to help maintain a secure and resilient operating environment.
2026
PHP2Shell - Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Last updated October 23, 2026.
METTLER TOLEDO is aware of two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, jointly referred to as PHP2Shell, in PHP. Both vulnerabilities are caused by use-after-free conditions during out-of-memory handling. These conditions may allow a subsequent request to access stale or uninitialized memory, creating a potential pathway for remote code execution.
METTLER TOLEDO is currently evaluating its products that may be impacted by CVE-2026-109618 and / or CVE-2026-109619. METTLER TOLEDO will publish corresponding Security Advisories on the CERT@VDE Dashboard as soon as the related information becomes available.
PHP has released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions prior to these are affected.