Technology News

myREX24 V2: Important Security Notice

Critical PHP Vulnerabilities "PHP2shell": Precautionary Security Measures and Potential Restrictions on Portal Access.

Update: October 23, 2026

PHP vulnerabilities: Current status and information for our customers

The security measures addressing the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 concern the myREX24 portal environments. Below you will find the current status and information on whether you need to take action.

myREX24 V2 Public Portal: Security updates completed

The required security updates have been successfully installed on our myREX24 V2 Public Portal. The portal is available for use again.

Users of the Public Portal do not need to take any action regarding these vulnerabilities. The portal environment was updated centrally.

Helmholz hardware products are not affected

The PHP vulnerabilities mentioned above do not affect any Helmholz hardware products. These two vulnerabilities do not require firmware updates or changes to device configurations for these products.

Please distinguish between the devices themselves and the portal environment used to manage remote access connections.

myREX24 V2.virtual: Update required for self-managed servers

Firmware version 2.21.6, which addresses these vulnerabilities, has been available for self-managed myREX24 V2.virtual instances since October 23, 2026.

If you have already installed the update successfully, no further action is required regarding this security update. The precautionary restrictions on inbound web access introduced for this purpose can be lifted.

If you have not yet completed the update, please install it as soon as possible. Until the update has been completed successfully, your instance’s web interface must remain protected against direct access from the Internet.

Please coordinate any necessary firewall permissions with your IT department or IT service provider.

Support and further information

If you are unsure which portal version you are using or need assistance with the update, please contact Helmholz Support.

This status update relates to the two PHP vulnerabilities specified above. We will provide further information if new security-relevant findings emerge.

Your Helmholz PSIRT Team

Update: October 22, 2026

myREX24 V2

Some connections, including connection establishment by devices, may currently be slower than usual. We expect performance to improve over the course of tomorrow.

myREX24 V2 .virtual

We are working on the update and currently expect to make firmware for the virtual servers available this afternoon. Please share this information with your support team and any other relevant colleagues.

myREX24 V2: Important Security Notice
October 21, 2026

The German Federal Office for Information Security (BSI) has issued a warning about two critical security vulnerabilities in PHP. This software component is also used in the myREX24 V2 portal software. Together with our technology partner, we are currently assessing whether and to what extent our portal software is affected.

Precautionary measure for the myREX24 V2 Public Portal

As a precaution, we will temporarily restrict public access to the myREX24 V2 Public Portal’s web interface to reduce the exposed attack surface.
Access to the web interface may therefore be limited or temporarily unavailable. Please inform the relevant members of your team and take this into account when planning service activities. We will implement this measure for the Public Portal.

Important information for operators of myREX24 V2.virtual

We recommend the same precautionary measure for your own myREX24 V2.virtual instance: Please have your IT administrator restrict public access to the frontend, i.e. the web interface, without delay.
This measure applies exclusively to web access. It does not mean disconnecting the entire instance from the internet. Simply logging out of the web interface is insufficient, as this does not change its public accessibility.
Please forward this information directly to your IT administrator or IT service provider. Keep the web interface access restriction in place until we inform you of the assessment results and the next steps.

Updates and further information

The official PHP security updates and technical information will be assessed immediately upon publication. Any necessary changes to the myREX24 portal software will then be implemented and tested. Corresponding myREX24 updates will be provided as quickly as possible. We cannot currently give a confirmed release date.
According to the current technical assessment provided by our technology partner, the associated router and firewall products are not affected by these PHP vulnerabilities.
We will keep you informed about further measures, available updates and the conditions for lifting the access restriction.

Thank you for your understanding and cooperation.