Industrial Vendors Assess Products Affected by PHP2Shell Flaws

Industrial vendors including Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories signalling that some of their OT and industrial products are affected by the PHP2Shell vulnerabilities. PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that allow unauthenticated remote code execution.

PHP’s fixes arrived on 21 October for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure. Cloudflare has reported millions of exploitation attempts since the first exploit activity began on 17 October, with initial industry observations suggesting no confirmed exploitation—yet the first confirmed attacks targeting honeypots were noted over the weekend, SecurityWeek reports.

Schneider Electric identifies three affected products: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering; mitigations include Security Expert version 1.48.4.0 and LINEoptimize remediation, while EcoStruxure Control Engineering users have to rely on mitigations for now.

Siemens states Ruggedcom APE1808 devices running PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are affected, with patches and workarounds provided by Palo Alto Networks and Siemens advising customers to contact support. ABB warns that MES deliveries containing DokuWiki are affected, with updates to PHP packages on hosting servers required; B&R indicates APROL is affected up to R 4.4-65, with patches expected. Rockwell Automation says it is checking product exposure and, as of the advisory, no products confirmed affected. Various other OT vendors are assessing impact or have issued patches, mitigations or advisories as applicable.