PHP2Shell flaws added to CISA KEV catalog as OT vendors confirm affected products

Two PHP flaws land on CISA's known-exploited list

CISA added the pair of vulnerabilities known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on 26 October, marking both as under active exploitation. According to the OT Security Weekly DACH digest by consultant Max Gilg on dev.to, these flaws dominated the week's developments for industrial security in Germany, Austria and Switzerland. The digest rates the region's overall OT threat level as elevated for calendar week 44, with the power and grids, food and beverage, and machine building sectors each assessed as high.

The bugs reside in PHP itself, and upstream fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The harder problem for plant operators is that PHP is embedded in the web interfaces of industrial equipment, so patching a server runtime is not the whole story.

OT vendors confirm exposure

Per the digest, several industrial vendors have already confirmed affected products: Siemens (RUGGEDCOM APE1808, with patch guidance handled through its support organisation), Schneider Electric, B&R (APROL), Belden NetModule (no patch available yet), HMS (Netbiter and Talk2M) and Wibu-Systems (CodeMeter License Central). Palo Alto's PAN-OS is also affected, which matters because PAN-OS powers edge and remote-maintenance deployments used by grid operators and municipal utilities.

For NetModule routers specifically, the digest recommends disabling the web interface entirely until a fix arrives, since no patch exists.

A crowded advisory week beyond PHP

The same weekly report flags several parallel developments:

• A Cisco ASA/FTD zero-day is being exploited to crash SSL-VPN appliances, the remote-access gateways many operators depend on for off-site maintenance. Cisco has confirmed exploitation; its interim mitigations depend on configuration and, as Cisco itself warns, weaken security.
• Siemens disclosed eight vulnerabilities in the web servers of SIMATIC S7-1500 and ET 200SP controllers under CISA advisory ICSA-26-295-14. Fixes are missing or pending for some of these widely deployed devices.
• An authentication bypass affects Mitsubishi Electric's ICONICS GENESIS64 and MC Works64 software (CISA advisory ICSA-26-300-02).
• Forescout research found refrigeration control systems exposed directly to the internet, including Copeland/Dixell XWEB and Danfoss StoreView products, while a pre-authentication flaw in Veeam Backup & Replication 13 puts recovery capability at risk.

Sector impact and reporting duties

For machine builders, the digest highlights a compliance dimension: manufacturers shipping PHP inside "products with digital elements" may face reporting obligations under the EU's Cyber Resilience Act. It advises checking software bills of materials or running firmware analysis now, and informing customers proactively where a report or notification is required.

The unpatched Siemens PLC web server flaws also affect machinery already installed at customer sites, so the digest suggests vendors send affected customers a brief service notice and track Siemens' patch timeline.

Recommended actions

The digest's short-term guidance concentrates on exposure reduction:

• Restrict firewall and edge-device management interfaces to a jump host, and apply the PHP fixes where available.
• Update Cisco ASA/FTD, monitor device restarts in the SIEM, and establish a second, independent remote-access path for on-call staff and service providers.
• Inventory S7-1500 and ET 200SP web servers and HMI access, disable unneeded services, and restrict remaining web access to trusted IP ranges.
• Move refrigeration and HVAC controllers off the public internet, route contractor access through an MFA-protected gateway with personal accounts, and evaluate temperature alarms independently of the controller.
• Prioritise patching by exploitation status and external reachability, starting with KEV-listed items, and keep at least one offline or immutable backup copy.

Why it matters

A KEV listing transforms these vulnerabilities from routine update queue items into urgent, deadline-driven patching priorities, because it certifies active exploitation in the wild. PHP2Shell's reach into Siemens, Schneider, B&R, HMS and Belden gear means the blast radius extends well beyond conventional web servers into controllers, license infrastructure and remote-access edge devices that keep plants running. With a separate zero-day simultaneously crashing the SSL-VPN appliances operators use for maintenance, both the endpoints and the access channels to them are under pressure at the same time. Where vendors have no patch yet, as with NetModule, compensating controls are the only defense, which makes asset inventory and exposure mapping the practical first step this week.