Siemens Energy Products Hit by Critical PHP RCE Flaws
Two unauthenticated RCE bugs in core PHP runtime affect multiple Siemens Building Automation and Energy products; patches partially available, CVSS 9.8.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.
CISA republished a Siemens ProductCERT advisory (SSA-166980) detailing the impact of two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime, publicly disclosed on October 21, 2026 and dubbed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Because these flaws reside in the PHP runtime itself rather than Siemens code, the advisory covers a broad swath of Siemens' energy and building-automation portfolio, including AMIS TS, blueplanet 360 NX3 variants, Energy Engage (V2.0SP9 and V3.1SP1), Heliox Rapid Local Monitoring, and the Spectrum Power 3/4/7/TG product lines. One of the vulnerabilities is characterized as a Use After Free condition with a CVSS v3 score of 9.8, indicating ease of exploitation and severe impact.
Siemens states it is still assessing the full scope of impact across its product lines and has released updated versions for some affected products while mitigations are recommended for others pending fixes. The advisory has been revised multiple times (five revisions between October 26 and November 12, 2026) as Siemens updated its known-affected and known-not-affected lists, reflecting an evolving investigation rather than a finalized remediation set.
No evidence of active exploitation against Siemens products specifically is mentioned in this advisory; it is a vendor impact assessment following the broader PHP runtime disclosure. CISA and Siemens recommend standard ICS hardening: minimizing network exposure, isolating control system networks behind firewalls, using VPNs for remote access, and applying vendor-provided updates with validation and trained oversight. Given the critical infrastructure (energy sector) deployment and the unauthenticated RCE nature of the underlying PHP flaws, affected operators should prioritize patching per Siemens' per-product guidance and monitor for further advisory updates.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs