Plan ahead High Check your exposure
Siemens reviews which products are hit by PHP 'php2shell' flaws
Siemens ProductCERTSiemens, PHPCVE-2026-109618, CVE-2026-109619
What happened. On 21 October 2026 the PHP project and researchers disclosed two unauthenticated remote code execution flaws in the PHP runtime, known as "php2shell" (CVE-2026-109618 and CVE-2026-109619). Siemens advisory SSA-566435 covers the impact on its software products.
Who is affected. The report does not name the affected Siemens products. It says the advisory covers the status of various Siemens software products.
What to do. Read Siemens advisory SSA-566435 and check whether any Siemens software you run is listed as affected, then apply the fixes or mitigations it gives.
When to act. Plan ahead: EPSS 11% chance of exploitation within 30 days
Editor's reading
Forasset ownerIT securityvendor/integrator
- Are you exposed?
Check your asset inventory against the product list in Siemens advisory SSA-566435 to find software that bundles the PHP runtime.
- If you cannot fix it yet
- Restrict network access to web interfaces of any affected Siemens software to trusted hosts only.
- Block internet access to servers running PHP-based Siemens software until the advisory's guidance is applied.
- Watch for
- Unexpected requests or new processes spawned by the web server on hosts running PHP-based software.
- Unauthenticated requests to PHP-based web interfaces from unfamiliar addresses.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Siemens ProductCERT (opens cert-portal.siemens.com)
More on Siemens PHP CVE-2026-109618 CVE-2026-109619