Critical PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

The Behnke-Station up to version 6.56 ships a PHP runtime affected by CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2). An unauthenticated attacker with network access to the web interface may execute arbitrary code on the device.

Public proof-of-concept exploits exist, and exploitation attempts against internet-facing PHP installations have been reported. We are not aware of any exploitation of the Behnke-Station at the time of publication.

Remedy

Update to version 6.80 or later. Until then, do not expose the web interface to the internet.