Siemens, Schneider Electric, ABB, Rockwell Automation va Johnson Controls kabi sanoat gigantlari yaqinda e'lon qilingan PHP2Shell zaifliklarining o'z mahsulotlariga ta'siri haqida mijozlarni xabardor qilish uchun maslahatlar e'lon qildi.
Ushbu kompaniyalarning bir nechtasi o'zlarining ba'zi sanoat va operatsion texnologiya (OT) mahsulotlari ta'sirlanganligini tasdiqladi. Boshqalar hali ham ta'sirni baholamoqda yoki o'z mahsulotlari ta'sirlanmaganligini aniqladi.
PHP2Shell — bu CVE-2026-109618 va CVE-2026-109619 deb nomlangan, PHP dvigatelidagi ikkita muhim kamchilik bo'lib, ular autentifikatsiyasiz masofaviy kod bajarish uchun ishlatilishi mumkin. PHP ularni 21-oktabrda 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalari bilan tuzatdi, bu ma'lumot rejalashtirilgan e'lon qilishdan oldin onlayn tarzda sizib chiqqanidan keyin sodir bo'ldi.
Birinchi ekspluatatsiya urinishlari 17-oktabrda, tuzatishlar chiqarilishidan oldin kuzatildi va Cloudflare o'shandan beri millionlab urinishlar haqida xabar berdi. Kiberxavfsizlik sanoati dastlab PHP2Shell muvaffaqiyatli ekspluatatsiyasini ko'rmagan bo'lsa-da, birinchi tasdiqlangan hujumlar (honeypotlarga qaratilgan) dam olish kunlari davomida xabar qilindi.
Schneider Electric o'zining uchta mahsuloti ta'sirlanganligini aniqladi: EcoStruxure Security Expert, ProLeiT LINEoptimize (avvalgi Plant iT LMS) va EcoStruxure Control Engineering.
Mijozlar Schneider'ning Customer Care Center'dan Security Expert'ning tuzatilgan 1.48.4.0 versiyasini olishlari mumkin, ProLeiT qo'llab-quvvatlashi esa LINEoptimize uchun tuzatishni taqdim etishi mumkin. EcoStruxure Control Engineering foydalanuvchilari hozircha faqat yumshatish choralari bilan cheklanishlari mumkin.
Siemens mijozlarga Palo Alto Networks'ning PAN-OS 10.2, 11.1, 11.2, 12.1 va 12.2 versiyalarida ishlaydigan Ruggedcom APE1808 qurilmalari ta'sirlanganligini ma'lum qildi. Mijozlarga tuzatish ma'lumotlari uchun Siemens qo'llab-quvvatlashiga murojaat qilish va Palo Alto Networks tomonidan taqdim etilgan vaqtinchalik choralardan foydalanish tavsiya etildi.
Alohida maslahatda Siemens ta'sirlanmagan deb tasdiqlangan mahsulotlar ro'yxatini e'lon qildi, jumladan CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter va Xpedition mahsulotlari.
ABB yordam sahifalarini ko'rsatish uchun ishlatiladigan DokuWiki'ni o'z ichiga olgan Manufacturing Execution System (MES) yetkazib berishlari ta'sirlanganligini ogohlantirdi. Mijozlar DokuWiki'ni joylashtirgan serverlardagi PHP paketlarini yangilashlari kerak. ABB sho'ba korxonasi B&R o'zining APROL jarayonni boshqarish tizimi R 4.4-65 gacha bo'lgan versiyalarda ta'sirlanganligini aytdi. Tuzatishlar 26-oktabr va 29-oktabrda kutilgan edi.
Rockwell Automation o'z mahsulotlaridan birortasi zaif PHP versiyasiga tayanadimi yoki yo'qligini tekshirmoqda. "Ushbu xabarnoma sanasiga ko'ra, hech bir Rockwell Automation mahsuloti ta'sirlangan deb tasdiqlanmagan," deb aytdi kompaniya maslahatida.
PHP2Shell ta'sirini tekshirayotgan boshqa OT yetkazib beruvchilari
Johnson Controls bir nechta Illustra mahsulot liniyalari, jumladan Flex4, Pro4, Gen5 va Essentials Gen 4 qurilmalari uchun tuzatishlar e'lon qildi. Uning Visonic PowerManage mahsuloti 5.0.45 versiyasida tuzatilgan.
Belden o'zining NetModule NRSW'ning barcha versiyalari, jumladan eng so'nggi asosiy reliz ham ta'sirlanganligini va tuzatilgan versiya hali chiqarilmaganligini aytdi. Ayni paytda kompaniya veb-interfeysni o'chirishni tavsiya qiladi. Belden'ning macmon 6.x va 7.x versiyalari ham ta'sirlangan. 7.x uchun tuzatish mavjud, 6.x foydalanuvchilari esa yangilash tavsiya etilgan.
HMS Networks Netbiter qurilmalari uchun dasturiy ta'minot yangilanishini e'lon qildi. HMS shuningdek, o'zining Talk2M xizmatlari va Argos hujjatlashtirish serveridan zaif PHP versiyalarini tuzatgan yoki olib tashlaganligini va hech qanday buzilish belgilarini topmaganligini aytdi. Anybus mahsulotlari ta'sirlanmagan.
Wibu-Systems CodeMeter License Central'ning veb-interfeysi va uning PHP-ga asoslangan kengaytmalari ta'sirlanganligini aytdi. Kompaniya yangilanishlarni e'lon qildi.
Hitachi Energy o'z mahsulotlaridan birortasi ta'sirlanganmi yoki yo'qligini tekshirmoqda va Moxa hech biri ta'sirlanmaganligini aniqladi.
Bog'liq: Node2Shell: Brotli kamchiligi Microsoft, Node.js, Python paketlarida tuzatishni keltirib chiqardi
Bog'liq: Siemens Software Center zaifligi ClickFix zararli dastur hujumlarida ekspluatatsiya qilindi
Bog'liq: Supermarket sovutish tizimiga hujum Copeland, Dixell boshqaruvchilariga kengaydi
Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosedPHP2Shellvulnerabilities on their products.
Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure.
The first exploitation attempt was seen on October 17, before the fixes were released, and Cloudflare has since reported millions of attempts. While the cybersecurity industry initially saw no successful PHP2Shell exploitation, the first confirmed attacks (aimed at honeypots) were reported over the weekend.
Schneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.
Customers can obtain the patched Security Expert version 1.48.4.0 from Schneider’s Customer Care Center, while ProLeiT support can provide a remediation for LINEoptimize. EcoStruxure Control Engineering users can only rely on mitigations for the time being.
Siemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected. Customers have been told to contact Siemens support for patch information and to apply the workarounds provided by Palo Alto Networks.
In a separate advisory, Siemens shared a list of products confirmed as unaffected, including CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter, and Xpedition products.
ABB warned that Manufacturing Execution System (MES) deliveries that include DokuWiki, which is used to display help pages, are affected. Customers need to update the PHP packages on the servers hosting DokuWiki. ABB subsidiary B&R said its APROL process control system is affected in versions up to R 4.4-65. Patches were expected on October 26 and October 29.
Rockwell Automation is checking whether any of its products rely on a vulnerable PHP version. “As of the date of this notice, no Rockwell Automation products have been confirmed as affected,” the company said in an advisory.
Other OT vendors investigating PHP2Shell impact
Johnson Controls has released patches for several Illustra product lines, including Flex4, Pro4, Gen5 and Essentials Gen 4 devices. Its Visonic PowerManage product has been fixed in version 5.0.45.
Belden said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released. In the meantime, the company recommends disabling the web interface. Belden’s macmon versions 6.x and 7.x are affected as well. A patch is available for 7.x, while 6.x users have been advised to upgrade.
HMS Networks has released a firmware update for Netbiter devices. HMS also said it has patched or removed vulnerable PHP versions from its Talk2M services and Argos documentation server, and that it found no indicators of compromise. Anybus products are not affected.
Wibu-Systems said the web interface of CodeMeter License Central and its PHP-based extensions are affected. The company has released updates.
Hitachi Energy is investigating whether any of its products are affected, and Moxa determined that none are impacted.
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Related: Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers