Several major industrial companies, including Siemens, Schneider Electric, ABB, Rockwell Automation, and Johnson Controls, have issued advisories to their customers regarding the impact of the PHP2Shell vulnerabilities on their operational technology products. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect the PHP engine, enabling potential remote code execution without authentication.
Impact on Industrial Products
Some companies have confirmed that their products are vulnerable, while others continue to assess the risk. PHP released patches on October 21, following an unauthorized leak, through versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Despite the patch release, Cloudflare reported millions of exploitation attempts, with initial attacks emerging before the patches were available.
Advisories and Mitigation Efforts
Schneider Electric identified that three of its products, EcoStruxure Security Expert, ProLeiT LINEoptimize, and EcoStruxure Control Engineering, are affected. Updated versions are available for some products, while mitigations are advised for others. Siemens highlighted that its Ruggedcom APE1808 devices running specific versions of PAN-OS are vulnerable and provided guidance for customers.
ABB has notified customers that Manufacturing Execution System (MES) deliveries with DokuWiki are affected, suggesting updates to the PHP packages. Meanwhile, ABB subsidiary B&R is working on patches for its APROL process control system. Rockwell Automation is still determining the vulnerability status of its products.
Ongoing Investigations and Responses
Johnson Controls has rolled out patches for several Illustra product lines. Belden confirmed that its NetModule NRSW and macmon versions are impacted, with patches available for some versions. HMS Networks has updated firmware for Netbiter devices and addressed vulnerabilities in its services.
Wibu-Systems released updates for its CodeMeter License Central, and Hitachi Energy is currently investigating its product line for vulnerabilities. Moxa reported no impact on its products, demonstrating the varied responses from different companies.
As these firms work to secure their systems, the importance of timely updates and vulnerability management remains crucial in mitigating potential threats from PHP2Shell and similar vulnerabilities.
