Industrial and operational-technology vendors are assessing exposure to PHP2Shell, while CISA has added the two vulnerabilities to its Known Exploited Vulnerabilities Catalog.

SecurityWeek reports that PHP2Shell consists of CVE-2026-109618 and CVE-2026-109619, critical PHP flaws that allow unauthenticated remote code execution. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The affected products identified by vendors include Schneider Electric’s EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering; Siemens Ruggedcom APE1808 devices running specified Palo Alto Networks PAN-OS versions; ABB Manufacturing Execution System deliveries containing DokuWiki; and B&R APROL versions up to R 4.4-65. SecurityWeek also reports exposure in Belden NetModule NRSW and macmon, Wibu-Systems CodeMeter License Central, and several Johnson Controls Illustra product lines.

Vendor response varies. Schneider has a patched Security Expert release, while ProLeiT customers can obtain remediation through support and EcoStruxure Control Engineering users currently have mitigations. Belden recommends disabling the NRSW web interface until a patch is available, with a patch or upgrade path for affected macmon versions. ABB advises customers to update PHP packages on servers hosting DokuWiki, and HMS Networks has released a Netbiter firmware update. Rockwell Automation had not confirmed an affected product at the time of its advisory; Moxa determined that its products were not impacted, while Hitachi Energy was still investigating.

BleepingComputer reports that CISA added both CVEs to its actively exploited catalog and directed federal civilian agencies to secure their systems by Thursday. The report says honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26. That establishes exploitation of the PHP flaws, but neither fetched source confirms that any of the industrial products listed above was compromised.

The documented response therefore differs by product: some vendors provide patches or firmware updates, some direct customers to support or upgrades, some recommend temporary mitigations, and others report no affected products or are still investigating. The sources do not establish that resolving one vendor’s exposure addresses the broader PHP2Shell risk.