Summary
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.
Vulnerabilities 2
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026
Revision history
-
#7
Added Opcenter Execution Process and Opcenter Execution Discrete to "Known Not Affected Product" list
-
#6
Added Pathway to Learning Engineering, Teamcenter Share and Designcenter X Essentials to "Known Not Affected Product" list
-
#5
Added Opcenter Execution Pharma to "Known Not Affected Product" list
-
#4
Added Opcenter Execution Foundation, Opcenter Quality, Opcenter Intelligence, Opcenter RDnL, AX4, Supply Chain Suite, Opcenter Intra Plant Logistics, Opcenter Connect Electronics, Xcargo, Designcenter and Designcenter X
-
#3
Added Insights Hub, Simcenter Flux and Simcenter Simlab
-
#2
Added Valor NPI, Solid Edge and Capital to "Known Not Affected Product" list
-
#1
Publication Date
References
-
SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-566435.html