A group of industry and operational technology (OT) giants, including Siemens, Schneider Electric, ABB, and Rockwell Automation, have issued urgent security warnings to their customers regarding the impact of security vulnerabilities known as PHP2Shell on some of their products. These warnings come at a time when digital platforms are witnessing widespread exploitation attempts of these vulnerabilities.
Technical details of the vulnerability
The PHP2Shell vulnerabilities consist of two security flaws identified as CVE-2026-109618 and CVE-2026-109619, which are critical bugs in the PHP language engine. These vulnerabilities allow attackers to perform Remote Code Execution without the need for authentication, granting them potential control over affected systems. The PHP Foundation released software patches on October 21 via versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, following the leak of information regarding the vulnerability before its official announcement.
According to reports from Cloudflare, millions of exploitation attempts have been observed, with the first actual intrusion attempts beginning on October 17, prior to the release of the software fixes.
Why does this news matter?
The danger of this development lies in the shift of the threat from traditional information technology (IT) environments to operational technology (OT) environments that manage critical infrastructure. The ability to execute remote code in industrial control devices means that attackers may not only steal data but could also manipulate physical processes, potentially leading to production line shutdowns or physical damage to equipment. Furthermore, the reliance of many Manufacturing Execution Systems (MES) and control interfaces on PHP packages makes them a direct target for this vulnerability.
Impact of the vulnerability on major manufacturers
The response of companies varied based on their assessment of the affected products:
- Schneider Electric: Confirmed that three products are affected: EcoStruxure Security Expert (update 1.48.4.0 is available), ProLeiT LINEoptimize, and EcoStruxure Control Engineering (which currently relies on mitigation measures only).
- Siemens: Reported that Ruggedcom APE1808 devices running Palo Alto Networks PAN-OS systems are affected. Conversely, the company confirmed that products such as Teamcenter, Opcenter, and Simcenter are not affected.
- ABB: Warned that Manufacturing Execution Systems (MES) using DokuWiki to display help pages are affected, as is the APROL process control system belonging to B&R (a subsidiary of ABB).
- Belden: Reported that all versions of NetModule NRSW are affected and advised disabling the web interface as a precautionary measure until a patch is released.
- Johnson Controls: Issued patches for the Illustra and Visonic PowerManage product lines.
For its part, Rockwell Automation is still conducting inspections to determine the exposure of its products, while other companies such as Moxa and HMS Networks (for Anybus products) have confirmed that their systems are not affected.