PHP 'php2shell' flaws now listed as known exploited; Siemens still assessing products

Siemens ProductCERTSiemens, PHPCVE-2026-109618, CVE-2026-109619

What happened. CISA now lists the two php2shell flaws (CVE-2026-109618 and CVE-2026-109619) as known exploited. They let an unauthenticated attacker run code remotely in the PHP runtime. Siemens is still assessing its products and has not yet published fixes.

Who is affected. Siemens software products that may use the PHP runtime. The source does not name specific products or versions. Other industrial vendors are also checking their products.

What to do. Check whether your Siemens software runs PHP, and watch Siemens ProductCERT for updated guidance and fixes. Apply them when published.

When to act. Act today: on CISA's list of known exploited flaws

Editor's reading

Forasset ownerOT security leadIT security

Purdue level: L3.5
L3
L2
Level 3.5, the industrial DMZ; Level 3, site operations; Level 2, supervisory control (HMIs, SCADA, engineering workstations)
Why: The report names Siemens software products running a PHP runtime but no specific component, so server-side software at site operations (L3), supervisory (L2) and the industrial DMZ (L3.5) is the likely placement.
Are you exposed?: Search your asset inventory for Siemens software with PHP-based web components, and compare it against SSA-166980 as Siemens updates it.
If you cannot fix it yet: Block internet access to web interfaces of Siemens software that may run PHP.
Restrict access to those web interfaces to known administration hosts through the firewall.
Segment servers running PHP-based software away from controllers and the corporate network.
Watch for: Unexpected web requests or new processes spawned by PHP web services on Siemens servers.
Web interfaces of OT servers receiving connections from unknown or internet-facing addresses.
ATT&CK for ICS: T0866Exploitation of Remote Services

Inferred from the facts above, not stated by the source. Check it against your own site before acting.

Source: Siemens ProductCERT (opens cert-portal.siemens.com)

More on Siemens PHP CVE-2026-109618 CVE-2026-109619

More from this briefing

Read the full issue Executive report Get it by email