The PHP2Shell flaws have now reached a device that many utilities and industrial sites trust to protect the plant. On 23 October, Siemens ProductCERT published security advisory SSA-566512, which confirms that every RUGGEDCOM APE1808 running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 is affected by CVE-2026-109618 and CVE-2026-109619. Both flaws are in PHP, the web programming language, and allow remote code execution (RCE), which means an attacker who can reach the vulnerable web service could run their own commands on the device without logging in. Siemens rates the advisory 9.8 out of 10 under version 3.1 of the Common Vulnerability Scoring System (CVSS) and 9.2 under version 4.0.
Why this one matters to operational technology (OT) teams: the RUGGEDCOM APE1808 is a ruggedized, utility-grade Siemens platform that hosts a Palo Alto Networks next-generation firewall (NGFW) at substations and harsh industrial sites. PAN-OS is the operating system that runs that firewall. In other words, the flaw sits inside the security boundary device itself, not just in a server behind it.
What the vendors say so far:
- Siemens (SSA-566512): all APE1808 devices with the PAN-OS versions above are affected. Siemens asks owners to contact Siemens customer support for patch and update information, and to apply the workarounds in the Palo Alto Networks advisory until then.
- Palo Alto Networks: the issue affects only the PAN-OS management web interface, which is the web login page and its application programming interface (API), plus any regular network interface that has a management profile attached. The GlobalProtect virtual private network (VPN) and the captive portal are not affected. Hotfixes are scheduled to arrive between 26 and 30 October, depending on the PAN-OS release. Customers with a Threat Prevention subscription can turn on Palo Alto's published threat signatures to block attacks in the meantime.
- Siemens (SSA-566435): Siemens also checked its software portfolio and lists 26 products as not affected because they do not contain PHP. These include Opcenter Execution Core, Opcenter X, Polarion, Teamcenter, Tecnomatix Plant Simulation and the PADS, Xpedition and HyperLynx design tools. That advisory lists no affected Siemens software at this time.
Where things stand on exploitation: attempts against PHP2Shell are widely reported. Amazon saw attempts against its honeypots (decoy systems built to attract attackers) starting 17 October, four days before the flaws were made public, and watchTowr has seen attempts in its own honeypots since 21 October. No successful compromise has been publicly confirmed. The Cybersecurity and Infrastructure Security Agency (CISA) says it has not observed successful exploitation, and the flaws are not in its Known Exploited Vulnerabilities (KEV) catalog as of 24 October. Palo Alto Networks says it is not aware of malicious exploitation against its products. The fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but on an appliance like the APE1808, the fix has to come from the vendors.
Where it shows up, plant floor to cloud: field devices and controllers do not run PHP, but the firewall standing between the substation or plant network and the wide area network does. The APE1808 usually sits at the edge of the site, where it separates protection relays, remote terminal units and the control network from the utility wide area network, the corporate network and remote access paths. If its management page can be reached from the wrong network, the device meant to keep attackers out becomes a way in.
What the Red Tiger team recommends:
1. Find every RUGGEDCOM APE1808 in your fleet and record the PAN-OS release on each one. Contact Siemens support for the patch path, and plan to apply the hotfix through change control as soon as it is available for your release.
2. Lock down the management interface today. Allow access only from a dedicated jump host or named administrator workstations on a trusted internal network, never from the internet, and remove management profiles from any interface that does not need one.
3. If you have a Threat Prevention subscription, enable the Palo Alto threat signatures listed in its advisory, following the extra setup steps Palo Alto describes for protecting management traffic.
4. Watch the firewall itself. Review administrator logins, configuration changes and system logs going back to at least 17 October, and look into anything you cannot explain.
Related reading: our earlier advisory on PHP2Shell bulletins from Schneider Electric, ABB and B&R: https://www.redtigersecurity.com/advisory/php2shell-ot-vendor-bulletins-schneider-abb
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Siemens ProductCERT SSA-566512: https://productcert.siemens.com/productcert/html/ssa-566512.html
Siemens ProductCERT SSA-566435: https://productcert.siemens.com/productcert/html/ssa-566435.html
Palo Alto Networks advisory: https://security.paloaltonetworks.com/CVE-2026-109618
Amazon Threat Intelligence: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
Check out our resources and book a follow-up call with our team.
