Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
Operators running industrial control systems now have to check which vendor products carry the PHP engine flaws, several of which still lack full patches.
Several industrial vendors, including Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls, have published advisories assessing how the PHP2Shell flaws affect their operational technology. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution in the PHP engine and were fixed on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after details leaked early. Exploitation attempts began October 17, before the patches, and Cloudflare has counted millions of them, with the first confirmed attacks against honeypots reported over the weekend. Schneider Electric confirmed three affected products and provided a patched EcoStruxure Security Expert release, while Siemens flagged Ruggedcom APE1808 devices running affected PAN-OS versions. Several vendors, including Belden, still lack full patches, and Rockwell has not confirmed any impacted products so far.
Why it matters
The flaws allow unauthenticated remote code execution, and exploitation attempts began on October 17, before the October 21 fixes were released. Cloudflare has counted millions of attempts, so the exposure is not theoretical. Operational technology owners who depend on vendor advisories now face a split picture, with Schneider Electric and Siemens naming affected products and patches available for some, while others remain unpatched or unconfirmed. That gap means the window of risk for industrial sites stays open until each vendor's status is settled.
Series Critical PHP flaws
- Critical PHP flaws prompt urgent patching across a large share of the web
- Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
- Two PHP flaws patched after first confirmed in-the-wild attacks
- PHP2Shell flaws used in fast attack on European government, with wider scanning under way
- PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack
- AI Tools Speed Up Exploits of Long-Known PHP Flaws
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.