Industrial vendors are scrambling to audit their products for two critical PHP vulnerabilities — tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and already added to CISA's Known Exploited Vulnerabilities catalog — after the PHP project shipped emergency fixes on October 21, 2026. Schneider Electric has confirmed three product lines requiring immediate administrator action, while Rockwell Automation and Hitachi Energy have launched internal audits of their portfolios.
The wave of vendor bulletins — dubbed "PHP2Shell" by researchers because unauthenticated requests can escalate to full remote code execution — highlights a structural problem in OT environments: PHP runtimes ship embedded in industrial web portals, engineering tools, and documentation viewers, and these components rarely receive automatic updates.
The Two Vulnerabilities at a Glance
-
CVE-2026-109618 (OOM memory corruption RCE): when a request hits the memory_limit exactly, it leaves partially initialized internal data structures behind; a subsequent request can trigger memory corruption. Under Apache mod_php with default settings, an unauthenticated request can achieve full RCE. The PHP Foundation rates mod_php as the highest-risk SAPI; PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP are also affected.
-
CVE-2026-109619 (stale global state RCE): after a fatal error, internal state points to memory freed by the previous request (use-after-free); later requests on the same worker can be weaponized.
-
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026.
-
Exploitation status: CISA added both CVEs to the KEV catalog on October 26, 2026, confirming active exploitation, with a patch deadline of October 29 for US federal agencies. Canada's Cyber Centre (AL26-026) reports public PoC code.
Vendor Status: Who's Affected and What To Do Now
-
Schneider Electric (SESB-2026-295-01): three product lines require action — EcoStruxure Security Expert (versions below 1.48.4.0 are affected; fixed in 1.48.4.0, available via Customer Care Center), ProLeiT LINEoptimize (all versions; fixes via ProLeiT support), and EcoStruxure Control Engineering (all versions; no patch yet — apply mitigations only).
-
Siemens (SSA-566512): RUGGEDCOM APE1808 running affected Palo Alto PAN-OS releases requires patching via Siemens support. Siemens separately confirmed (SSA-566435) that CADRA, Opcenter, Teamcenter, and Xpedition are not affected — and core SIMATIC controllers were not implicated in the PHP advisories.
-
Rockwell Automation (SD1802): actively auditing which products bundle affected PHP versions; no product confirmed vulnerable as of publication.
-
Hitachi Energy: internal investigation in progress (advisory 8DBD000267); no conclusions yet.
-
Johnson Controls (JCI-PSA-2026-24): Illustra Flex4/Pro4/Gen5 and Essentials Gen 4 cameras have patches available; PowerManage fixed in 5.0.45.
-
ABB: MES deliveries bundling DokuWiki are affected (4HZK000017); B&R APROL affected up to R 4.4-65 (SA26P015) with patches released October 26 and 29.
-
Belden: NetModule NRSW all versions affected with no patch currently available (disable the web management interface); macmon 6.x/7.x affected, 7.x has a fix.
-
Moxa (MPSA-260001): confirmed its hardware product lines are fully unaffected.
Why Industrial Devices Are Exposed to a PHP Bug
Controllers themselves rarely run PHP. The exposure sits one layer up — in the L3/L3.5 servers and appliances that surround control systems:
-
Bundled web management portals on network appliances and access devices.
-
Engineering and MES tools that embed PHP-based components like DokuWiki for documentation.
-
License and security servers (for example, CodeMeter-based components) that ship with vendor software stacks.
Because these components are delivered with the product and not tied to IT patch cycles, industrial facilities routinely run PHP versions that are years old — which is why formal vendor tracking mechanisms are being established while the audit wave continues.
What OT Operators Should Do Before the Patch Wave Arrives
-
Inventory first. Identify every system in the plant that runs PHP — web portals on appliances, engineering workstations, MES add-ons, documentation servers. The audit is the hard part; patching is easy.
-
Upgrade PHP to fixed versions (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) wherever you control the stack, and apply vendor firmware patches like Schneider's Security Expert 1.48.4.0 as they land.
-
Apply the CVE-2026-109619 workaround where patching isn't possible: set
session.upload_progress.enabled=0 in php.ini.
-
Isolate what you can't patch. Disable web management interfaces on affected appliances (as Belden recommends for NetModule), restrict management access to jump hosts, and keep L3.5/DMZ segments segmented from control networks.
-
Assume controllers were never the target. The risk is in the surrounding server infrastructure — which makes it a good moment to review whether your spare-parts strategy covers the network and security appliances at that layer, from Modicon M580 processors and ControlLogix 5580 controllers to the 1756-EN2TR Ethernet modules that carry management traffic.
Hardening an OT network often surfaces legacy hardware questions too — from network appliances to the controllers and I/O behind them. Contact PLC Source PRO for tested-surplus replacements that keep upgrade projects moving without OEM lead times.
Key Takeaways
- Two unauthenticated PHP RCEs (CVE-2026-109618, CVE-2026-109619, both CVSS 9.2) were patched on October 21, 2026; both are in CISA's KEV catalog with confirmed active exploitation.
- Schneider Electric confirmed three product lines requiring immediate action: EcoStruxure Security Expert, ProLeiT LINEoptimize, and EcoStruxure Control Engineering.
- Siemens' exposure is limited to RUGGEDCOM APE1808 with PAN-OS; Rockwell and Hitachi Energy are still auditing; Moxa confirmed its hardware is unaffected.
- Industrial exposure lives in bundled web portals, engineering tools, and documentation components on L3/L3.5 servers — not in PLCs themselves.
- Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Where patching isn't possible, disable web interfaces and segment management networks.
Frequently Asked Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to CVE-2026-109618 (memory corruption RCE triggered by requests that hit the memory limit under mod_php) and CVE-2026-109619 (use-after-free in stale global state after fatal errors). Both allow unauthenticated remote code execution, are rated CVSS 9.2, and were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released October 21, 2026. CISA added them to the KEV catalog on October 26 after confirming active exploitation.
Which Schneider Electric products are affected?
Per advisory SESB-2026-295-01, three product lines: EcoStruxure Security Expert (fixed in version 1.48.4.0), ProLeiT LINEoptimize (all versions, fixes via ProLeiT support), and EcoStruxure Control Engineering (all versions, mitigations only until a patch ships). Operators should obtain the Security Expert update through the Customer Care Center and apply network mitigations to the other two lines immediately.
Are PLCs like Modicon M580 or ControlLogix affected by the PHP vulnerabilities?
No. Current vendor advisories implicate PHP-based web components — management portals, engineering tools, and embedded applications like DokuWiki — not PLC controller firmware. Siemens confirmed SIMATIC controllers were not implicated in its PHP advisories. The practical risk is to the Windows/Linux servers and network appliances surrounding the control network, which is why segmentation and management-access restrictions are the priority mitigations.
Sources: PHP Foundation · SecurityWeek · CISA Alert · Canadian Cyber Centre AL26-026 · Siemens SSA-566512 · Red Tiger Security