# ECHARGE-SA-2026-001: PHP vulnerability "PHP2Shell"

| | |
| --- | --- |
| Published | 22 October 2026 |
| Last updated | 22 October 2026 |
| References | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical (CVSS 4.0 score 9.2 according to the PHP project) |
| Affected | All stations with Salia controller: standard firmware up to 2.4.20, Eichrecht firmware up to 2.90.6, and the 2.5.0 betas |
| Status | Fix in preparation, firmware 2.5.0 |

## What happened

On 21 October 2026 the PHP project published two vulnerabilities in the PHP
runtime, known together as "PHP2Shell". A specially crafted request to a PHP
page can lead to code execution on the server without a login. The
vulnerability affects practically every web server that runs PHP, and it is
being actively exploited on the internet against public web servers.

The web interface of Salia charging stations runs on PHP. The vulnerability is
therefore present in the station firmware.

## Affected products

All charging stations with the Salia controller, for example cPH2, cPP2, cPµ2
and cPP1, in both firmware lines:

- Standard firmware: every version up to and including 2.4.20, and the 2.5.0
  beta.
- Eichrecht firmware: every version up to and including 2.90.6, and the 2.5.0
  beta.

## When a station is exposed

A station can only be attacked by someone who can reach its web interface over
the network.

- A station in a home or company network behind a router, with no port
  forwarding, is **not reachable from the internet**. An attacker would already
  need access to the local network.
- A station whose web interface has been made reachable from the internet
  through a **port forwarding** on the router is exposed and should be treated
  as at risk until it runs the fixed firmware.
- Remote access through a **VPN** does not expose the station.

Using the eCharge app or an OCPP connection to a backend does not make the
station reachable from the internet. Both connections are opened by the
station itself, outbound.

## Immediate measures

1. If the web interface of a station is reachable from the internet, remove the
   port forwarding on the router now. Use a VPN for remote access instead.
2. Do not forward any ports to the station until it runs the fixed firmware.
3. Install firmware 2.5.0 as soon as it is available, see below.

## Fix

PHP 8.1, the version in the station firmware, no longer receives releases from
the PHP project. The official source fix for PHP 8.1 is being integrated into
the station firmware. Firmware **2.5.0** will contain it, for the standard and
the Eichrecht line. The release date will be added here; the firmware can then be requested through the
[firmware download portal](/firmware/download-portal).

Because the fix is applied at source level, the PHP version reported by the
station stays 8.1.34. The release notes of 2.5.0 state that the fix is
included.

## Timeline

| Date | Step |
| --- | --- |
| 21 October 2026 | PHP project publishes the vulnerabilities and the source fix for PHP 8.1 |
| 21 October 2026 | eCharge confirms the station firmware is affected and starts the fix |
| 22 October 2026 | Fix integrated into the firmware, test build and station test started; this advisory published |
| tbd | Firmware 2.5.0 released with the fix |