[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEkRV27YFb0rqYMvEH7NEXG3fjTYo0-hYamX6dIM8fcU":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"03d98c39-e686-40dc-9a64-d2a494290d89","Industrial Vendors Check Products for PHP2Shell Vulnerabilities","industrial-vendors-check-products-for-php2shell-vulnerabilities-71d694","Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities. The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.","Several major industrial vendors, including Siemens, Schneider Electric, and ABB, have confirmed that their products are impacted by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These flaws in the PHP engine allow for unauthenticated remote code execution and were exploited in the wild before patches were released. Vendors are issuing advisories, providing updates, or recommending mitigations for affected operational technology (OT) products.","Industrial vendors Siemens, Schneider Electric, and ABB confirm PHP2Shell vulnerabilities affect some of their products.","https:\u002F\u002Fwww.securityweek.com\u002Findustrial-vendors-check-products-for-php2shell-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002FPLC-HMI-SCADA-ICS-industrial.jpeg","2026-10-26T14:52:14+00:00","2026-10-26T15:00:11.689317+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Siemens","vendor",{"name":21,"type":19},"Schneider Electric",{"name":23,"type":19},"ABB",{"name":25,"type":19},"Rockwell Automation",{"name":27,"type":19},"Johnson Controls",{"name":29,"type":30},"PAN-OS","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":51,"value":55,"context":53},"CVE-2026-109619",[18,21,23],{"controls":58,"vendors":142},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,97,105],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":89,"product_name":94,"url":95,"description":96},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[143],{"slug":144,"name":18,"logo_path":145,"roles":146},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"critical-php2shell-flaws-expose-ot-products-to-unauthenticated-remote-code-execution","Critical PHP2Shell Flaws Expose OT Products to Unauthenticated Remote Code Execution","Multiple leading industrial vendors — Siemens, Schneider Electric, and ABB — confirmed their operational technology (OT) products were vulnerable to critical PHP engine flaws enabling unauthenticated remote code execution, exploited in the wild before patches were available. The root cause lies in inadequate vulnerability management: OT environments frequently lag behind IT environments in patching cadence due to uptime requirements and limited vendor support windows. This matters enormously because compromised OT systems can bridge digital attacks into physical processes, threatening safety, production continuity, and critical infrastructure. The zero-day exploitation window demonstrates that relying solely on vendor patches is insufficient without compensating controls such as network segmentation and monitoring.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 requires operators of essential services to implement vulnerability handling and disclosure practices; industrial vendors and their OT customers fall under this obligation and must have processes to respond to critical flaws like PHP2Shell within mandated timeframes.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timelines — had this control been enforced, OT vendors and asset owners would have had structured processes to respond to PHP2Shell before exploitation occurred.","With active in-the-wild exploitation confirmed, a mature incident response plan — including pre-defined OT isolation playbooks and vendor coordination procedures — would have enabled faster containment and reduced the window of exposure across affected industrial environments.","The PHP2Shell flaws represent exactly the risk OWASP A06 addresses — vulnerable third-party components (the PHP engine) embedded in vendor products that organisations fail to track and update, creating exploitable attack surfaces.","PHP2Shell was exploited in the wild before patches existed; a continuous vulnerability management programme would have ensured compensating controls were applied immediately upon CVE publication and patches deployed at the earliest vendor-supported opportunity.","A.8.8 mandates timely identification and remediation of technical vulnerabilities; applying this to OT product inventories would have triggered mitigating action — such as disabling vulnerable services — as soon as the flaws were disclosed.","The vulnerability allowed unauthenticated remote code execution — enforcing strong access control and authentication at the network perimeter around OT assets would have prevented exploitation even before a patch was available."]