Industrial Vendors Report PHP2Shell Impact on OT Products
Summary
Industrial vendors report varying PHP2Shell impact across OT products: some are affected and patched or have mitigations, while others remain under assessment or report no impact. The PHP flaws enable unauthenticated remote code execution.
Key points
- PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, critical PHP engine flaws enabling unauthenticated remote code execution. PHP released fixes on October 21 for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Exploitation attempts were observed on October 17, before fixes were released. Cloudflare reported millions of attempts; the first confirmed attacks reported targeted honeypots.
- Schneider Electric confirmed three affected products: EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering. Fixes or mitigations vary by product.
- Siemens said Ruggedcom APE1808 devices running specified PAN-OS versions are affected and advised customers to contact support and apply Palo Alto Networks workarounds. Siemens also listed products confirmed unaffected.
- ABB said MES deliveries including DokuWiki are affected and require PHP package updates. B&R APROL versions through R 4.4-65 are affected, with patches expected October 26 and 29.
- Johnson Controls released fixes for several Illustra product lines and Visonic PowerManage. Belden said NetModule NRSW and macmon versions are affected; it recommends disabling the NRSW web interface while a patch is pending.
- HMS Networks and Wibu-Systems released updates. Rockwell Automation is still checking exposure, while Moxa said its products are unaffected.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution (RCE)
- Severity
- Critical
- Affected Versions
- Ruggedcom APE1808 running PAN-OS 10.2
- Ruggedcom APE1808 running PAN-OS 11.1
- Ruggedcom APE1808 running PAN-OS 11.2
- Ruggedcom APE1808 running PAN-OS 12.1
- Ruggedcom APE1808 running PAN-OS 12.2
- B&R APROL versions up to R 4.4-65
- Belden NetModule NRSW: all versions, including the latest mainline release
- Belden macmon versions 6.x and 7.x
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Update the PHP packages on servers hosting DokuWiki.
- Disable the web interface on NetModule NRSW.
- Apply the workarounds provided by Palo Alto Networks for affected Ruggedcom APE1808 devices.
CVE
CVE-2026-109618PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution.CVE-2026-109619PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution.
Vendors
ABBIndustrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities onB&RABB subsidiary B&R said its APROL process control system is affected in versions up to R 4.4-65.BeldenBelden said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released.CloudflareThe first exploitation attempt was seen on October 17, before the fixes were released, and Cloudflare has since reported millions of attempts.Hitachi EnergyHitachi Energy is investigating whether any of its products are affected, and Moxa determined that none are impacted.HMS NetworksHMS Networks has released a firmware update for Netbiter devices.Johnson ControlsIndustrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities onMoxaHitachi Energy is investigating whether any of its products are affected, and Moxa determined that none are impacted.Palo Alto NetworksSiemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected.PHPPHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution.Rockwell AutomationIndustrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities onSchneider ElectricIndustrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities onSiemensIndustrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities onWibu-SystemsWibu-Systems said the web interface of CodeMeter License Central and its PHP-based extensions are affected.
Products
APROLABB subsidiary B&R said its APROL process control system is affected in versions up to R 4.4-65.Argos documentation serverHMS also said it has patched or removed vulnerable PHP versions from its Talk2M services and Argos documentation server, and that it found no indicators of compromise.CodeMeter License CentralWibu-Systems said the web interface of CodeMeter License Central and its PHP-based extensions are affected.DokuWikiABB warned that Manufacturing Execution System (MES) deliveries that include DokuWiki, which is used to display help pages, are affected.EcoStruxure Control EngineeringSchneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.EcoStruxure Security ExpertSchneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.macmonBelden’s macmon versions 6.x and 7.x are affected as well.NetbiterHMS Networks has released a firmware update for Netbiter devices.NetModule NRSWBelden said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released.PAN-OSSiemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected.ProLeiT LINEoptimizeSchneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.Ruggedcom APE1808Siemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected.Talk2MHMS also said it has patched or removed vulnerable PHP versions from its Talk2M services and Argos documentation server, and that it found no indicators of compromise.Visonic PowerManageIts Visonic PowerManage product has been fixed in version 5.0.45.