PHP2Shell - Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Siemens is aware of two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, jointly referred to as PHP2Shell, in PHP. Both result from use-after-free conditions triggered during out-of-memory handling, where stale or uninitialized request memory can be read or branched on by a subsequent request, allowing remote code execution.

We are evaluating the impact to Siemens products. For Siemens products that are affected by CVE-2026-109618 or CVE-2026-109619, as well as those that are known not affected, corresponding security advisories (SSA) will be published as soon as the related information becomes available. The following information is currently available:

• SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
• SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products

PHP has released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions prior to these are affected.

Note: Please be aware that links in the Blog Post may refer to external websites and content.