Schneider Electric, Siemens, ABB and other industrial suppliers have confirmed PHP2Shell exposure in selected products, but available remedies differ: some customers have patches, while others must obtain support guidance or use temporary mitigations. Rockwell Automation and Hitachi Energy are still assessing their products.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime and can enable remote code execution without authentication. SecurityWeek reports that PHP issued corrected versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, following an online leak before the planned disclosure.
Attack activity preceded those fixes. According to SecurityWeek, an exploitation attempt was first observed on October 17, and Cloudflare subsequently reported millions of attempts. Reports over the weekend described the first confirmed successful exploitation against honeypots—systems used to observe attacks. That evidence concerns honeypots; it does not establish that the industrial products identified in these notices were compromised.
Where patches and interim measures differ
Schneider Electric’s response covers three products, according to SecurityWeek. For EcoStruxure Security Expert, the corrected release is 1.48.4.0, available through the company’s Customer Care Center. Users of ProLeiT LINEoptimize, previously called Plant iT LMS, can obtain remediation from ProLeiT support. EcoStruxure Control Engineering remains dependent on mitigations for now.
At ABB, exposure depends on a component included in certain Manufacturing Execution System deliveries: DokuWiki, which provides help pages. The remedy is to update PHP packages on the servers running DokuWiki. ABB subsidiary B&R also identified its APROL process control system through version R 4.4-65 as affected. Patches were expected on October 26 and October 29; those were scheduled dates, rather than confirmation that releases had become available.
Johnson Controls has issued patches for Illustra devices in several lines, including Flex4, Pro4, Gen5 and Essentials Gen 4. For its Visonic PowerManage product, version 5.0.45 contains the fix.
Belden’s NetModule NRSW has a different status: all versions, including the latest mainline release, are affected, and a corrected release was still pending. Belden recommends disabling its web interface in the meantime. The company’s macmon 6.x and 7.x branches are also affected. A patch exists for 7.x; customers using 6.x have been directed to upgrade.
HMS Networks has made a firmware update available for Netbiter devices. For its hosted Talk2M services and Argos documentation server, the company says it has already patched or removed vulnerable PHP versions. HMS reported finding no indicators of compromise and identified Anybus products as unaffected.
Updates are also available from Wibu-Systems for the affected CodeMeter License Central web interface and its PHP-based extensions.
Siemens ties RUGGEDCOM exposure to PAN-OS
The deployment condition matters for Siemens’ RUGGEDCOM APE1808 application hosting platform. Its October 23 advisory, SSA-566512, covers all APE1808 versions with Palo Alto Networks PAN-OS in the 10.2, 11.1, 11.2, 12.1 and 12.2 release trains. Every version within those PAN-OS trains is listed as affected by both vulnerabilities.
Siemens directs these customers to support for patch and update information and to the workarounds in Palo Alto Networks’ upstream security notifications.
Its technical explanation describes two routes to unsafe memory use. For CVE-2026-109618, PHP uses longjmp() to leave the current context when an out-of-memory error occurs. Some contexts fail to handle that exit correctly, leaving request memory uninitialized before an allocation; cleanup can then read or branch on that memory.
CVE-2026-109619 concerns global state that can retain, or regain, references to request memory after it has been freed. Later requests may read or branch on those stale references before initialization is complete. Siemens says multiple strategies can trigger each condition and lead to remote code execution.
The advisory gives CVE-2026-109618 a CVSS v3.1 score of 9.8 and CVE-2026-109619 a score of 8.1. Both receive 9.2 under CVSS v4.0. Those scores describe severity, independently of the observed attack activity.
Unaffected findings have specific boundaries
Siemens’ separate software advisory, SSA-566435, also dated October 23, identifies products without the affected PHP component. It lists all versions of CADRA, DFMExpress, HyperLynx, Polarion, QuadView, Simcenter Flomaster, Tecnomatix Plant Simulation and TestWay as unaffected.
The same finding covers Opcenter Connect MOM, Opcenter Execution Core and Opcenter X; PADS Pro Essentials, Pro Student Edition, Professional, Professional - XCR, Standard & Standard Plus, and Standard - XCR; and Teamcenter Active Workspace, Deployment Center, Product Cost Management and Visualization.
For Xpedition, the named products are Designer, Enterprise, Enterprise XCR, IC Packaging and Layout Browser. These findings apply to the listed products and should not be extended to entire product families.
Elsewhere, the reviews remain at different stages. SecurityWeek reports that Rockwell Automation had confirmed no affected products as of its notice but was still checking for vulnerable PHP dependencies. Hitachi Energy was also investigating. Moxa, by contrast, had concluded that none of its products were affected.
