Siemens, Schneider, ABB check products for PHP2Shell flaws
Industrial vendors Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls issued advisories on the impact of the critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619. Schneider confirmed three affected products, Siemens flagged Ruggedcom APE1808 devices running PAN-OS, and ABB reported MES with DokuWiki and APROL up to R 4.4-65. PHP patched the flaws on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- PHP2Shell covers two critical PHP flaws allowing unauthenticated RCE
- PHP fixes shipped October 21; first exploitation attempt seen October 17
- Schneider Electric: Security Expert, LINEoptimize and Control Engineering affected
- ABB: APROL patches were expected on October 26 and October 29
Read next
Business