Industrial Vendors Check Products for PHP2Shell Vulnerabilities

What it is

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical PHP engine flaws that allow unauthenticated remote code execution. PHP fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after details leaked online before the planned disclosure. The page is a roundup of OT vendor responses, and its value is the per-product status the summary leaves out. It gives no exploit mechanism.

Exploitation status

The first exploitation attempt was seen on 17 October, four days before the fixes. Cloudflare has reported millions of attempts. The first confirmed successful attacks, aimed at honeypots, were reported over the weekend before the article.

Preconditions / Affected

Exposure comes from a product bundling or depending on a vulnerable PHP version, often in a web interface or documentation server.

• Schneider Electric: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS) and EcoStruxure Control Engineering.
• Siemens: Ruggedcom APE1808 devices running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2.
• ABB: Manufacturing Execution System deliveries that include DokuWiki, used for help pages.
• B&R (ABB subsidiary): APROL process control system, versions up to R 4.4-65.
• Belden: all versions of NetModule NRSW, including the latest mainline release. Also macmon 6.x and 7.x.
• Johnson Controls: Illustra Flex4, Pro4, Gen5 and Essentials Gen 4 devices, plus Visonic PowerManage.
• HMS Networks: Netbiter devices, and its Talk2M services and Argos documentation server. Anybus products are not affected.
• Wibu-Systems: the CodeMeter License Central web interface and its PHP-based extensions.

Siemens lists these as unaffected: CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter and Xpedition. Moxa reports no impact. Rockwell Automation had confirmed no affected products as of its notice, but was still checking. Hitachi Energy was still investigating.

What to do

• Schneider: get Security Expert 1.48.4.0 from the Customer Care Center. ProLeiT support can provide a LINEoptimize remediation. Control Engineering has mitigations only for now.
• Siemens: contact Siemens support for APE1808 patch information and apply the workarounds from Palo Alto Networks.
• ABB: update the PHP packages on the servers hosting DokuWiki.
• B&R: APROL patches were expected on 26 October and 29 October. The page does not say which date applies to which release.
• Johnson Controls: apply the released Illustra patches and update Visonic PowerManage to 5.0.45.
• Belden: NetModule NRSW has no patch yet, so disable the web interface. For macmon, a patch exists for 7.x, and 6.x users should upgrade.
• HMS Networks: install the Netbiter firmware update. HMS reports it patched or removed vulnerable PHP in Talk2M and Argos and found no indicators of compromise.
• Wibu-Systems: install the released CodeMeter License Central updates.

Caveats

Control Engineering and NetModule NRSW have no fix, only mitigations. The page gives no fixed versions for several products (LINEoptimize, Illustra, Netbiter, CodeMeter), so check each vendor advisory. Rockwell Automation and Hitachi Energy results may change.