Multiple IT and OT Vendors Disclose PHP2Shell Vulnerability Impact and Patch Status; Industrial Systems from Siemens and Schneider Affected
iThome's compilation shows that major industrial and IT vendors, including Siemens and Schneider Electric, have confirmed that some of their products are affected by the PHP2Shell vulnerability and are releasing patches or mitigations.
As the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) become public, major global Information Technology (IT) and Operational Technology (OT) vendors have released security advisories disclosing the impact on their products and remediation progress. Since PHP is widely used in management interfaces and backend services, this vulnerability threatens not only web servers but also industrial automation systems and critical infrastructure.
In the OT sector, Germany's Siemens confirmed that its RUGGEDCOM APE1808 series routers are affected if running specific versions of Palo Alto Networks PAN-OS, recommending users upgrade to available versions. France's Schneider Electric stated that EcoStruxure Security Expert versions prior to 1.48.4.0, all versions of ProLeiT LINEoptimize, and EcoStruxure Control Engineering are affected, providing corresponding upgrade or patch solutions. Switzerland's ABB indicated risks in its B&R APROL system and MES systems bundled with Dokuwiki, planning to release patches for specific versions by late October. US-based Johnson Controls also confirmed that its CEM AC2000 building automation controllers and certain video surveillance products are affected, offering hotfixes.
In the IT and security software domain, Alex Spokoiny, Chief Security & Trust Officer at Check Point, argued that enhanced AI capabilities have led to the disclosure of more severe vulnerabilities, presenting challenges similar to the previous Log4Shell incident. Check Point itself confirmed that Force Firewalls, Spark Firewalls, and Cloud Firewalls are affected when enabling specific remote access features, with hotfixes now available for most versions. Citrix announced that NetScaler ADC and Gateway are affected due to their PHP-based management interface, expecting to release patched versions on October 27. Broadcom, Cisco, and AWS also disclosed affected components and repair timelines for their respective product lines, with AWS noting that some Amazon Linux versions were affected but patched in late October.