View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms.
Siemens Building Automation and Energy Products
About this summary. This is a short excerpt from the description that CISA published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
Source attribution: headline and facts are from CISA (cisa.gov). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Siemens RUGGEDCOM APE1808
View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens…
Critical Vulnerabilities in PHP Require Immediate Patching
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These…
Php2shell: A Network Edge Risk Playbook
TL;DR: Most appliance vendors have shipped php2shell fixes. The remaining exposures linger in devices that will stay vulnerable until someone replaces them. On October…
php2shell one week later: Why one exploit doesn’t work everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup…
Hitachi Energy TRO600 series products
View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can…
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…