Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Major industrial automation vendors including Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have issued security notices addressing exposure to the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution against the PHP engine. PHP maintainers shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after details leaked ahead of schedule, and exploitation attempts began as early as October 17, with Cloudflare later logging millions of probes and the first confirmed hits landing against honeypots. Schneider Electric confirmed impact on EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering, while Siemens flagged Ruggedcom APE1808 devices running certain Palo Alto Networks PAN-OS versions as vulnerable but cleared many other product lines. ABB, B&R, Belden, HMS Networks, Wibu-Systems and Johnson Controls have each released patches or workarounds for specific affected products, whereas Rockwell Automation, Hitachi Energy and Moxa reported no confirmed impact so far, underscoring how deeply embedded PHP components can complicate OT supply-chain remediation.