SSA-566435

Siemens Security Advisory by Siemens ProductCERT

SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products

Publication Date:	2026-10-23
Last Update:	2026-10-23
Current Version:	V1.0

SUMMARY

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
CADRA All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
DFMExpress All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
HyperLynx All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Opcenter Connect MOM All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Opcenter Connect MOM does not use PHP in any part of its product architecture (Component Not Present)
Opcenter Execution Core All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Opcenter Execution Core does not use PHP in any part of its product architecture (Component Not Present)
Opcenter X All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Opcenter X does not use PHP, therefore it is not affected by these critical vulnerabilities and no remediations are needed (Component Not Present)
PADS Pro Essentials All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
PADS Pro Student Edition All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
PADS Professional All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
PADS Professional - XCR All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
PADS Standard & Standard Plus All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
PADS Standard - XCR All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Polarion All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Polarion suite is not impacted by PHP as there is no usage of PHP. Polarion out of the box components do not use PHP (Component Not Present)
QuadView All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Simcenter Flomaster All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Simcenter Flomaster is not affected by the PHP issue (Component Not Present)
Teamcenter Active Workspace All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Teamcenter suite is not impacted by PHP as there is no usage of PHP (Component Not Present)
Teamcenter Deployment Center All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Teamcenter suite is not impacted by PHP as there is no usage of PHP (Component Not Present)
Teamcenter Product Cost Management All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Teamcenter Product Cost Management is not impacted by PHP as there is no usage of PHP (Component Not Present)
Teamcenter Visualization All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Teamcenter suite is not impacted by PHP as there is no usage of PHP (Component Not Present)
Tecnomatix Plant Simulation All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	Tecnomatic Plant Simulation is not impacted by PHP as there is no usage of PHP (Component Not Present)
TestWay All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Xpedition Designer All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Xpedition Enterprise All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Xpedition Enterprise XCR All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Xpedition IC Packaging All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Xpedition Layout Browser All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)

MITIGATIONS

Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

HyperLynx is an integrated family of analysis tools for PCB design, schematic capture and post-layout verification

Opcenter Execution Core (formerly known as Camstar Enterprise Platform) by Siemens PLM Software is a universal usable Manufaturing Execution System (MES). This product allows manufacturers to significantly increase the quality of a product during manufacturing process. The process begins with the planning, supply management, quality management, stretching to production and even to customer service. This effectively supports the whole product life-cycle.

Polarion is an application lifecycle management solution that improves software development processes with a single, unified solution for requirements, coding, testing, and release.

Teamcenter Active Workspace is a web application for accessing the Teamcenter system that provides an identical and seamless experience on any computer or smart device.

Teamcenter Deployment Center is a web based installer that helps to easily install, patch, and upgrade Teamcenter software across a various other environments.

Teamcenter Visualization software enables enterprises to enhance their product lifecycle management (PLM) environment with a comprehensive family of visualization solutions. The software enables enterprise users to access documents, 2D drawings and 3D models in a single environment.

Tecnomatix Plant Simulation allows you to model, simulate, explore and optimize logistics systems and their processes. These models enable analysis of material flow, resource utilization and logistics for all levels of manufacturing planning from global production facilities to local plants and specific lines, well in advance of production execution.

Xpedition is an innovative PCB design flow application, providing integration from system design definition to manufacturing execution.

Xpedition Layout Browser is a free tool to view and share of Xpedition PCB Layout Designs and schematic cross-probe to Xpedition.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

Vulnerability CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS v3.1 Base Score	8.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-10-23):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.