PHP2Shell flaws move from scanning to working exploits; industrial vendors check exposure

· Cybersecurity

Two critical remote-code-execution vulnerabilities tracked as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, have moved from probing to confirmed exploitation in the wild. Attackers successfully exploited the flaws against honeypots, launching 35 shells from two IP addresses on October 24, according to SecurityWeek. The development pushed major industrial vendors to assess their products: Siemens, Schneider Electric, ABB and others have confirmed that some of their offerings are affected by the PHP2Shell vulnerabilities. The shift from reconnaissance to live shells is a key marker that defenders must patch now rather than treat the flaw as theoretical. Industrial and operational-technology environments are the immediate concern.

Why it matters：Confirmed exploitation turns a patching chore into an active incident for organizations running industrial and web-facing systems, and vendor confirmations widen the exposure beyond the PHP ecosystem itself.

Key points

  • Attackers launched 35 shells from two IP addresses against honeypots on October 24
  • Siemens, Schneider Electric and ABB have confirmed some products are affected
  • The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619

Sources (original reporting)

More stories from this day