For awareness Medium Check exposure in your normal cycle
Bundled PHP flaws called php2shell affect Helmholz myREX24V2
CERT@VDE advisoriesHelmholz, myREX24V2, myREX24V2.virtual
What happened. CERT@VDE reports that Helmholz myREX24V2 and myREX24V2.virtual ship with a bundled PHP version affected by two vulnerabilities known as "php2shell". The advisory is VDE-2026-160. The report gives no impact details.
Who is affected. Sites using Helmholz myREX24V2 or myREX24V2.virtual for remote access are exposed, because vendors and engineers often reach plant systems this way.
What to do. Check whether you run myREX24V2 or myREX24V2.virtual and follow the fix guidance in advisory VDE-2026-160.
When to act. For awareness: myREX24V2 users: details are thin and no exploitation is stated, so check exposure first.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L5
- L3.5
Why: The myREX24V2 is a remote-access router at the plant edge, so its web interface sits at the boundary between plant and outside networks (L3.5, L5).
- Are you exposed?
Search the asset inventory for myREX24V2 and myREX24V2.virtual units and check whether their web interface is reachable from outside.
- If you cannot fix it yet
- Limit access to the router's web interface to known administration hosts.
- Keep the router's management interface off the internet until the fix is applied.
- Watch for
- Unexpected requests to PHP pages on the router's web interface from unknown sources.
- New or changed files and configuration on the router.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CERT@VDE advisories (opens certvde.com)
More on Helmholz myREX24V2 myREX24V2.virtual