B. Braun Statement on PHP2SHELL

1 Summary

B. Braun is aware of the critical vulnerabilities in PHP identified as CVE-2026-109618 and CVE-2026-109619, commonly referred to as “php2shell”. The vulnerabilities were publicly addressed on 21 October 2026 by the German Federal Office for Information Security (BSI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and others. They may allow unauthenticated remote code execution in PHP installations serving web requests.

• B. Braun immediately initiated a product-specific assessment. The technical assessments are ongoing.

• At the time of publication, B. Braun is not aware of any cybersecurity incidents related to these vulnerabilities affecting B. Braun products, nor of any associated impact on patient safety.

• The following B. Braun products have been evaluated and are not affected because they do not use PHP:

*) All currently supported versions

Further products are under investigation. This security communication will be updated.

2 Recommendations

Customers must not independently install, update or modify PHP or other software components that form part of a B. Braun product unless specifically instructed by B. Braun through applicable product documentation or a product-specific security Customers must not independently install, update or modify PHP or other software components that form part of a B. Braun product unless specifically instructed by B. Braun through applicable product documentation or a product-specific security communication.

Until the product-specific assessments are completed, B. Braun recommends applying the following compensating controls where technically and operationally feasible:

• Network segmentation: Place B. Braun medical devices and associated systems in appropriately segmented and protected network zones, using controls such as firewalls or VLANs.

• Restricted network access: Limit communication to authorized users, trusted systems and the ports, protocols and destinations required for the intended operation.

• Reduced external exposure: Do not expose B. Braun medical devices or associated product systems directly to the internet. Restrict access from untrusted networks.

• Web application firewall: Where a web-facing component is present and the hospital architecture supports it, consider a web application firewall as an additional compensating control. CISA states that a WAF may provide some protection until systems are updated or patched.

• Remote access: Restrict remote access to authorized, monitored and trusted connections. Disable unnecessary remote-access paths where supported by the approved product configuration.

• Monitoring: Monitor network and system activity for suspicious or unexpected behavior. CISA specifically recommends monitoring for PHP worker processes launching shells or downloading tools.

• Incident response: Investigate suspicious activity under the organization’s incident-response procedures and contact B. Braun if a B. Braun product may be involved.

These measures are compensating controls and do not replace product-specific remediation where required.

3 References 

• BSI: PHP – Critical vulnerabilities threaten web applications worldwide (German language)

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching

• CVE Record: CVE-2026-109618

• CVE Record: CVE-2026-109619

4 Contact and further information  

Please contact our global product security team at productsecurity@bbraun.com if you have any further questions, require detailed technical information, or have any other support issue concerning the security of our products and services.