Skip to content
OpenAdvisories
Critical 2 exploited CVEs SSA-166980 2 CVEs

SSA-166980: PHP2Shell Vulnerabilities in Siemens Products

Published Oct 26, 2026 · Updated Nov 5, 2026 · Revision 4

Vendor: Siemens Product: AMIS TS Product: blueplanet 360 NX3 M6 WM OD IISX Product: blueplanet 360 NX3 M6 WM OD IISX - S Product: Building X Product: Call stations Product: Chargesight Product: Climatix Cloud IC Product: Climatix Devices Product: Connect Insights Product: Connect X200 Product: Connect X300 Product: Connect X500 Product: cRSP Product: Depotfinity Product: Desigo CC Product: Desigo DXR2 Product: Desigo DXR3 Product: Desigo Optic Product: Desigo PXC3 Product: Desigo PXC4 Product: Desigo PXC5 Product: Desigo PXC7 Product: Energy Engage V2.0SP9 Product: Energy Engage V3.1SP1 Product: Energy Management System Product: Enlighted RTLS Product: Enlighted Space Product: Heliox Flex Pro Product: Heliox H60 +29 more

Summary

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals.

Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.

Vulnerabilities 2

  • Critical 9.2
    CVE-2026-109618 Exploited Public exploit Scanner template EPSS 100%

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026
  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit Scanner template EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026

Revision history

  1. #4

    Updated Known Not Affected and Known Affected Products list

  2. #3

    Added AMIS TS, Energy Engage V2.0SP9, Energy Engage V3.1SP1, Spectrum Power 3, Spectrum Power 4, Spectrum Power 7 and Spectrum Power TG to Affected Products and updated the list of known not affected

  3. #2

    Updated the Known not affected list

  4. #1

    Publication Date

References