Is WinCC OA affected by the current (10/2026) critical PHP vulnerability?

WinCC OA is not affected in any way.

As PHP is not used (WinCC OA does not include the affected PHP runtime), you are not affected.

If you use PHP elsewhere in your systems, we recommend—given the critical nature of the vulnerability—that you act promptly and implement the suggested countermeasures.
See e.g. https://cert.europa.eu/publications/security-advisories/2026-018 for further information.

PHP-related entries e.g. in the 3rd Party Software ReadMe_OSS.html list, such as php.js (included with HighCharts.js) and language-php, do not represent the PHP runtime/interpreter.

Please note: All WinCC OA related security vulnerabilities are communicated by Siemens ProductCERT through dedicated Security Advisories - https://productcert.siemens.com/?search=wincc+oa