Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosedPHP2Shellvulnerabilities on their products.
Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure.
The first exploitation attemptwas seen on October 17, before the fixes were released, and Cloudflare has since reported millions of attempts. While the cybersecurity industry initially saw no successful PHP2Shell exploitation, the first confirmed attacks (aimed at honeypots) were...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
