PHP2Shell (CVE-2026-109618, CVE-2026-109619) in industrial / OT products: which Schneider Electric, ABB, Siemens, Johnson Controls, Belden and HMS products are affected and what are the fixes?

What it is: PHP2Shell is a pair of critical PHP engine flaws that can allow unauthenticated remote code execution. PHP fixed them on October 21, 2026 (8.5.12, 8.4.27, 8.3.36, 8.2.35). Many industrial and building-automation products embed their own copy of PHP in web interfaces, so updating the operating system's PHP does not fix them: you need the vendor's update or mitigation. By October 26, several OT vendors had published bulletins. Affected products reported so far (check each vendor's bulletin for exact versions): - Schneider Electric (bulletin SESB-2026-295-01): EcoStruxure Security Expert before 1.48.4.0 (fixed in 1.48.4.0); ProLeiT LINEoptimize (remediation available); EcoStruxure Control Engineering (no product fix yet, mitigations only). - ABB (advisories of October 23): Manufacturing Execution System deliveries that include DokuWiki, and B&R APROL up to R 4.4-65; patches announced for October 26 and 29. - Siemens: RUGGEDCOM APE1808 devices running affected Palo Alto PAN-OS versions; contact Siemens support for the patch. Siemens lists many other product lines as not affected. - Johnson Controls: Illustra Flex4, Pro4, Gen5 and Essentials Gen 4 cameras; Visonic PowerManage (fixed in 5.0.45). - Belden: NetModule NRSW (patch pending) and macmon 6.x / 7.x. - HMS Networks: Netbiter devices; Talk2M and Argos services already patched. - Wibu-Systems CodeMeter License Central is also listed. Rockwell Automation, Hitachi Energy and Moxa had not confirmed any affected products. What to do: 1. Inventory OT and building systems that expose a web interface and match them against the vendor bulletins; ask vendors not yet listed whether their products bundle PHP. 2. Apply vendor fixes where available (Security Expert 1.48.4.0, PowerManage 5.0.45, ABB patches as released) during a maintenance window. 3. Until fixed: make sure these web interfaces are not reachable from the internet, restrict access to a management VLAN or jump host, put them behind a VPN with MFA, and block access from IT networks except for named admin hosts. 4. Monitor these hosts for unexpected processes, new files in web directories and outbound connections, since exploitation of PHP2Shell in the wild has been reported. After: re-check the vendor bulletins, which are being updated as investigations finish, and record which devices still rely on network mitigations. Sources: https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/ https://download.se.com/files?p_Doc_Ref=SESB-2026-295-01&p_File_Name=SESB-2026-295-01.pdf&p_enDocType=Security+and+Safety+Notice https://www.redtigersecurity.com/advisory/php2shell-ot-vendor-bulletins-schneider-abb