Siemens energy and building products affected by PHP2Shell
Original title: Siemens Building Automation and Energy Products
Fixes exist for some products, including PHP 8.1.34 release 6 and bt-monitoring-vm V20261103; several others have none.
On October 21, 2026, the PHP project and researchers disclosed two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, called php2shell. Siemens says multiple building automation and energy products are affected, including AMIS TS, blueplanet 360 models, Energy Engage, Spectrum Power, and Local Monitoring. Some products have vendor fixes; others have no fix available or no fix planned. Siemens says the assessment is ongoing and findings may change.
Unconfirmed: Siemens says the evaluation is ongoing and findings are subject to change.
- CVE-2026-109618 is scored CVSS 9.8 as a use-after-free.
- Energy Engage V3.1SP1 should move PHP to V8.1.34 release 6.
- Local Monitoring bt-monitoring-vm is fixed in V20261103 or later.
- Spectrum Power TG on Windows should upgrade PHP to V8.5.12.
- Energy Engage V2.0SP9 has no fix planned.
Impact: Unauthenticated remote code execution in the PHP runtime
| Product | Affected | Fixed in |
|---|---|---|
| Siemens Energy Engage V3.1SP1 | all | PHP V8.1.34 release 6 |
| Siemens Local Monitoring bt-monitoring-vm | < V20261103 | V20261103 or later |
| Siemens Spectrum Power TG | Windows systems using WebConsole and WebQuery | PHP V8.5.12 |
| Siemens Spectrum Power 7 using IHM (NagiosXI) | all | Red Hat PHP security patch for RHEL 8 and 9 |
| Siemens Energy Engage V2.0SP9 | all | — |
| Siemens AMIS TS | all | — |
- 1.Upgrade Energy Engage V3.1SP1 PHP to V8.1.34 release 6.
- 2.Update bt-monitoring-vm to V20261103 or later.
- 3.Apply the Red Hat PHP patch on Spectrum Power 7 using NagiosXI, or upgrade Spectrum Power TG PHP to V8.5.12.
- Vendors
- Siemens
- Products
- AMIS TSblueplanet 360 NX3 M6 WM OD IISXEnergy EngageLocal Monitoring bt-monitoring-vmSpectrum PowerHeliox Rapid
- Organizations
- CISASiemens ProductCERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
8 min read at cisa.govView CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.