ECHARGE-SA-2026-001: PHP vulnerability "PHP2Shell"
| Published | 22 October 2026 |
| Last updated | 22 October 2026 |
| References | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical (CVSS 4.0 score 9.2 according to the PHP project) |
| Affected | All stations with Salia controller: standard firmware up to 2.4.20, Eichrecht firmware up to 2.90.6, and the 2.5.0 betas |
| Status | Fix in preparation, firmware 2.5.0 |
What happened
On 21 October 2026 the PHP project published two vulnerabilities in the PHP runtime, known together as "PHP2Shell". A specially crafted request to a PHP page can lead to code execution on the server without a login. The vulnerability affects practically every web server that runs PHP, and it is being actively exploited on the internet against public web servers.
The web interface of Salia charging stations runs on PHP. The vulnerability is therefore present in the station firmware.
Affected products
All charging stations with the Salia controller, for example cPH2, cPP2, cPµ2 and cPP1, in both firmware lines:
- Standard firmware: every version up to and including 2.4.20, and the 2.5.0 beta.
- Eichrecht firmware: every version up to and including 2.90.6, and the 2.5.0 beta.
When a station is exposed
A station can only be attacked by someone who can reach its web interface over the network.
- A station in a home or company network behind a router, with no port forwarding, is not reachable from the internet. An attacker would already need access to the local network.
- A station whose web interface has been made reachable from the internet through a port forwarding on the router is exposed and should be treated as at risk until it runs the fixed firmware.
- Remote access through a VPN does not expose the station.
Using the eCharge app or an OCPP connection to a backend does not make the station reachable from the internet. Both connections are opened by the station itself, outbound.
Immediate measures
- If the web interface of a station is reachable from the internet, remove the port forwarding on the router now. Use a VPN for remote access instead.
- Do not forward any ports to the station until it runs the fixed firmware.
- Install firmware 2.5.0 as soon as it is available, see below.
Fix
PHP 8.1, the version in the station firmware, no longer receives releases from the PHP project. The official source fix for PHP 8.1 is being integrated into the station firmware. Firmware 2.5.0 will contain it, for the standard and the Eichrecht line. The release date will be added here; the firmware can then be requested through the firmware download portal.
Because the fix is applied at source level, the PHP version reported by the station stays 8.1.34. The release notes of 2.5.0 state that the fix is included.
Timeline
| Date | Step |
|---|---|
| 21 October 2026 | PHP project publishes the vulnerabilities and the source fix for PHP 8.1 |
| 21 October 2026 | eCharge confirms the station firmware is affected and starts the fix |
| 22 October 2026 | Fix integrated into the firmware, test build and station test started; this advisory published |
| tbd | Firmware 2.5.0 released with the fix |