Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities on their products.
Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure.
The first exploitation attempt was seen on October 17, before the fixes were released, and Cloudflare has since reported millions of attempts. While the cybersecurity industry initially saw no successful PHP2Shell exploitation, the first confirmed attacks (aimed at honeypots) were reported over the weekend.
Schneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.
Customers can obtain the patched Security Expert version 1.48.4.0 from Schneider’s Customer Care Center, while ProLeiT support can provide a remediation for LINEoptimize. EcoStruxure Control Engineering users can only rely on mitigations for the time being.
Siemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected. Customers have been told to contact Siemens support for patch information and to apply the workarounds provided by Palo Alto Networks.
In a separate advisory, Siemens shared a list of products confirmed as unaffected, including CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter, and Xpedition products.
ABB warned that Manufacturing Execution System (MES) deliveries that include DokuWiki, which is used to display help pages, are affected. Customers need to update the PHP packages on the servers hosting DokuWiki. ABB subsidiary B&R said its APROL process control system is affected in versions up to R 4.4-65. Patches were expected on October 26 and October 29.
Rockwell Automation is checking whether any of its products rely on a vulnerable PHP version. “As of the date of this notice, no Rockwell Automation products have been confirmed as affected,” the company said in an advisory.
Other OT vendors investigating PHP2Shell impact
Johnson Controls has released patches for several Illustra product lines, including Flex4, Pro4, Gen5 and Essentials Gen 4 devices. Its Visonic PowerManage product has been fixed in version 5.0.45.
Belden said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released. In the meantime, the company recommends disabling the web interface. Belden’s macmon versions 6.x and 7.x are affected as well. A patch is available for 7.x, while 6.x users have been advised to upgrade.
HMS Networks has released a firmware update for Netbiter devices. HMS also said it has patched or removed vulnerable PHP versions from its Talk2M services and Argos documentation server, and that it found no indicators of compromise. Anybus products are not affected.
Wibu-Systems said the web interface of CodeMeter License Central and its PHP-based extensions are affected. The company has released updates.
Hitachi Energy is investigating whether any of its products are affected, and Moxa determined that none are impacted.
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Related: Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
