Industrial vendors assess PHP2Shell; several OT products affected
Original title: Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
Siemens, Schneider Electric, ABB, Rockwell Automation, Johnson Controls and other OT vendors published PHP2Shell advisories for CVE-2026-109618 and CVE-2026-109619. PHP fixed the critical unauthenticated remote-code-execution flaws on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after details leaked early. The first exploitation attempt was seen on October 17, Cloudflare later reported millions of attempts, and confirmed attacks against honeypots followed. Several products have patches or mitigations; Rockwell has confirmed none affected, while Hitachi Energy is still investigating and Moxa found no impact.
Unconfirmed: Rockwell and Hitachi Energy had not finished assessing exposure when their notices were issued.
- Schneider patched Security Expert in 1.48.4.0; Control Engineering has mitigations only.
- Siemens Ruggedcom APE1808 on listed PAN-OS versions is affected; customers must contact support.
- B&R APROL through R 4.4-65 was due patches on October 26 and October 29.
- Belden NetModule NRSW has no patch yet; macmon 7.x is patched and 6.x should upgrade.
- Johnson Controls fixed Visonic PowerManage in 5.0.45 and patched several Illustra lines.
Impact: Unauthenticated remote code execution via the PHP engine
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| Schneider Electric EcoStruxure Security Expert | — | 1.48.4.0 |
| Schneider Electric ProLeiT LINEoptimize | — | — |
| Schneider Electric EcoStruxure Control Engineering | — | — |
| Siemens Ruggedcom APE1808 | PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 | — |
| ABB B&R APROL | up to R 4.4-65 | — |
| Johnson Controls Visonic PowerManage | — | 5.0.45 |
| Belden NetModule NRSW | all versions, including the latest mainline release | — |
| Belden macmon | 6.x and 7.x | patch available for 7.x |
- 1.Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on affected branches
- 2.Obtain named vendor patches, including Security Expert 1.48.4.0 and PowerManage 5.0.45
- 3.Disable the Belden NetModule NRSW web interface until a patch is released
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
3 min read at securityweek.com
Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities. The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.