On October 21, 2026, the PHP project and external security researchers disclosed two critical vulnerabilities in the core PHP language runtime — collectively referred to as "php2shell" — tracked as CVE-2026-109618 and CVE-2026-109619. Both are described as unauthenticated remote code execution flaws in the PHP engine itself, meaning any application embedding a vulnerable PHP runtime that exposes attacker-controllable input paths is a candidate target.
Siemens has responded with ICSA-26-316-01, an impact advisory covering its Building Automation and Energy product portfolio. This is the uncomfortable intersection every OT security practitioner dreads: a critical web-language runtime bug landing inside operational technology environments — building management systems (BMS), energy management platforms, and HVAC control infrastructure that were never engineered with internet-grade threat models in mind.
If you operate Siemens building automation or energy products — Desigo CC, Desigo Control Point, building operator workstations, or energy monitoring gateways — this advisory demands immediate triage. An unauthenticated RCE in an embedded PHP component translates directly into unauthenticated control over the host, and in a BMS context, that host often has trust relationships with field-level controllers.
Technical Analysis
Vulnerabilities
| CVE | Alias | Type | Authentication Required |
|---|---|---|---|
| CVE-2026-109618 | php2shell | Unauthenticated code execution in core PHP runtime | No |
| CVE-2026-109619 | php2shell | Unauthenticated code execution in core PHP runtime | No |
Both CVEs reside in the core PHP language runtime, not in a single web application. That distinction matters enormously for defenders: the blast radius is defined not by one product but by every product, appliance, and embedded component that bundles a vulnerable PHP interpreter and exposes it to network input — web UIs, REST endpoints, reporting services, CGI handlers, and management interfaces.
Affected Scope (Siemens Context)
Siemens' advisory (ICSA-26-316-01) covers the status of impact across various Siemens software products in the Building Automation and Energy domains. Key points from the advisory:
- Siemens is actively assessing which products embed the vulnerable PHP runtime and in what configuration. As with most vendor impact assessments, expect the advisory to be updated incrementally as product teams complete their analysis.
- Siemens' standing recommendation — reiterated in this advisory — is to restrict network access to devices using appropriate mechanisms and to deploy products in a protected IT environment per Siemens operational guidelines and product manuals.
- Building automation and energy products are the declared scope; operators of these systems should treat the advisory as a living document and subscribe for updates.
Why This Is Dangerous in OT/BMS Environments
From a defender's perspective, the exploitation chain is straightforward and grim:
- Exposure: A management interface, embedded web server, or API endpoint backed by PHP is reachable — on a flat OT network, a converged IT/OT segment, or worse, directly from the internet.
- Trigger: An unauthenticated attacker sends crafted input that reaches the vulnerable PHP code path (CVE-2026-109618 or CVE-2026-109619).
- Execution: The flaw yields code execution in the context of the PHP/web service process — frequently
SYSTEM,root, or a service account with broad local privileges on the management server or gateway. - Pivot: Building management servers hold credentials, project files, controller communication channels (BACnet, KNX, Modbus, OPC UA), and sometimes direct field-bus access. Code execution on the BMS server is functionally code execution on the building.
Physical consequences in this class of environment include HVAC manipulation, access control disruption, energy demand manipulation, and — in healthcare or data-center facilities — genuine life-safety and availability risk.
Exploitation Status
At the time of Siemens' advisory publication, the PHP project and researchers had disclosed the vulnerabilities; the advisory language indicates active assessment rather than confirmed in-the-wild exploitation against Siemens products specifically. However, practitioners should assume the following:
- Public disclosure of an unauthenticated RCE in PHP is a mass-exploitation starter pistol. Historically, critical PHP runtime bugs move from disclosure to automated scanning to commodity exploitation within days.
- Internet-facing PHP-backed management interfaces will be enumerated and probed aggressively.
- Monitor the CISA Known Exploited Vulnerabilities (KEV) catalog for additions of CVE-2026-109618 and CVE-2026-109619, and treat KEV inclusion as an immediate escalation trigger.
Detection & Response
The detection philosophy here is post-exploitation centric: since exploit payloads target the PHP runtime itself and specific trigger mechanics may evolve, the highest-fidelity signals are the consequences of successful exploitation — the web server or PHP process doing things a web service should never do.
Sigma Rules
The following rules target the two most reliable behavioral indicators of php2shell exploitation: (1) a web/PHP service process spawning a shell or command interpreter, and (2) a PHP CGI/FPM worker writing executable content into web-accessible or temp locations (webshell staging).
---
title: Web or PHP Service Process Spawning Shell (php2shell Post-Exploitation)
id: 3f8b2c14-7a1e-4d92-b6c5-9e0a4f2d8b71
status: experimental
description: Detects web server or PHP runtime processes spawning command interpreters or shells, a high-fidelity indicator of successful exploitation of unauthenticated PHP RCE flaws such as CVE-2026-109618 / CVE-2026-109619 (php2shell) against management interfaces including Siemens building automation platforms.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/21
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\httpd.exe'
- '\nginx.exe'
- '\php-cgi.exe'
- '\php.exe'
- '\w3wp.exe'
- '\apache.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate application maintenance scripts invoked by the web tier (rare; tune per application baseline)
- Vendor update mechanisms for building management software — validate against Siemens documented behavior
level: high
---
title: PHP or Web Worker Writing Executable Content to Web or Temp Directories (Webshell Staging)
id: 8c4d5e62-2b3f-4a18-9d07-6f1c3e5a9b24
status: experimental
description: Detects PHP runtime or web server worker processes creating script or executable files in webroot, temp, or public directories, consistent with webshell deployment following php2shell (CVE-2026-109618 / CVE-2026-109619) exploitation.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/21
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- '\httpd.exe'
- '\nginx.exe'
- '\php-cgi.exe'
- '\php.exe'
- '\w3wp.exe'
selection_ext:
TargetFilename|endswith:
- '.php'
- '.aspx'
- '.asp'
- '.exe'
- '.dll'
- '.bat'
- '.ps1'
selection_path:
TargetFilename|contains:
- '\inetpub\'
- '\wwwroot\'
- '\htdocs\'
- '\temp\'
- '\tmp\'
- '\ProgramData\'
- '\AppData\'
condition: selection_image and selection_ext and selection_path
falsepositives:
- Application installers or update services for the BMS platform; correlate with change windows and Siemens update packages
level: high
---
title: Linux PHP-FPM or Web Server Spawning Shell (php2shell Post-Exploitation)
id: 5e1a9f37-4c6d-4b28-8a53-0d7e2f6c1a98
status: experimental
description: Detects PHP-FPM, Apache, or Nginx processes spawning shells on Linux-based appliances and gateways, indicative of successful unauthenticated PHP runtime exploitation (CVE-2026-109618 / CVE-2026-109619). Applicable to Linux-hosted Siemens energy management components and embedded gateways forwarding audit logs.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/21
tags:
- attack.execution
- attack.t1059.004
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/php-fpm'
- '/php'
- '/httpd'
- '/apache2'
- '/nginx'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
- '/curl'
- '/wget'
condition: selection_parent and selection_child
falsepositives:
- Health-check or monitoring scripts executed by the web tier; baseline per host
level: high
KQL Hunt (Microsoft Sentinel / Defender)
This query hunts across both Windows endpoint telemetry (Defender) and ingested syslog/CEF from Linux appliances, gateways, and network devices — the realistic telemetry mix in an OT-adjacent environment. Run it against management servers and any host running PHP-backed interfaces.
// php2shell (CVE-2026-109618 / CVE-2026-109619) post-exploitation hunt
// Union of Defender endpoint telemetry and Syslog/CEF from Linux appliances
let WebParents = dynamic(["httpd.exe","nginx.exe","php-cgi.exe","php.exe","w3wp.exe","php-fpm","httpd","apache2","nginx"]);
let ShellChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","sh","bash","dash","python","python3","perl","nc","ncat","curl","wget"]);
let Endpoint =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (WebParents)
| where FileName has_any (ShellChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIP = "", Source="Defender";
let SyslogSide =
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("php-fpm", "httpd", "apache2", "nginx")
| where SyslogMessage has_any ("sh -c", "/bin/bash", "/bin/sh", "curl ", "wget ", "nc -", "python")
| project TimeGenerated, DeviceName = Computer, InitiatingProcessFileName = ProcessName, InitiatingProcessCommandLine = "", FileName = "", ProcessCommandLine = SyslogMessage, AccountName = "", InitiatingProcessRemoteIP = "", Source = "Syslog";
union Endpoint, SyslogSide
| sort by TimeGenerated desc
A second, companion hunt for inbound reconnaissance and exploit probing against PHP interfaces, using network telemetry:
// Hunt for external/unusual inbound connections to PHP-backed management interfaces
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where LocalPort in (80, 443, 8080, 8443)
| where InitiatingProcessFileName in~ ("httpd.exe","nginx.exe","php-cgi.exe","w3wp.exe","php.exe")
| where not(RemoteIP startswith "10.") and not(RemoteIP startswith "192.168.") and not(RemoteIP startswith "172.16.")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| where Connections > 50 or FirstSeen > ago(1d) // high-volume or newly seen external peers
| sort by LastSeen desc
Tune the RFC1918 exclusions to your environment — the point is to surface new or anomalous peers talking to web services that should, per Siemens' own guidance, only be reachable from a protected management segment.
Velociraptor VQL
For rapid triage of a suspected compromised management server, this artifact sweeps for shells parented by web/PHP processes and recently written script files in web-accessible paths:
-- php2shell triage: web/PHP processes spawning shells AND recent webshell artifacts
SELECT * FROM foreach(row={
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
'SuspiciousProcess' AS FindingType
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|mshta|rundll32|sh|bash|nc|ncat|curl|wget)'
}, query={
SELECT FindingType, Pid, Name, CommandLine, Exe, Username, CreateTime,
NULL AS FilePath, NULL AS FileMtime
FROM scope()
})
UNION ALL
SELECT 'SuspiciousFile' AS FindingType, NULL AS Pid, NULL AS Name,
NULL AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime,
FullPath AS FilePath, Mtime AS FileMtime
FROM glob(globs=[
'C:/inetpub/wwwroot/**/*.php',
'C:/inetpub/**/*.aspx',
'C:/**/htdocs/**/*.php',
'C:/Windows/Temp/**/*.php',
'C:/Windows/Temp/**/*.exe',
'/var/www/**/*.php',
'/tmp/*.php',
'/tmp/*.elf'
])
WHERE Mtime > now() - 1209600 -- written in last 14 days
Remediation / Verification Script
Until Siemens publishes product-specific fixes, the highest-leverage defensive action is verifying exposure and enforcing network restriction, exactly as the advisory directs. The following PowerShell script inventories PHP runtimes on a management server, identifies listening web services, and verifies whether they are bound to broadly accessible interfaces:
# php2shell exposure assessment for Siemens BMS/energy management servers
# Run elevated on each candidate host. Outputs a triage report.
$report = @()
# 1. Inventory installed PHP runtimes and versions
Write-Host "=== PHP Runtime Inventory ===" -ForegroundColor Cyan
$phpBinaries = Get-ChildItem -Path 'C:\','D:\' -Recurse -Include 'php.exe','php-cgi.exe','php-fpm*' -ErrorAction SilentlyContinue -Depth 4
foreach ($bin in $phpBinaries) {
$ver = (& $bin.FullName -v 2>$null | Select-Object -First 1)
$report += [PSCustomObject]@{ Check = 'PHP Runtime'; Detail = $bin.FullName; Value = $ver }
Write-Host "FOUND: $($bin.FullName) -> $ver" -ForegroundColor Yellow
}
# 2. Identify listening web ports and owning processes
Write-Host "`n=== Listening Web Services ===" -ForegroundColor Cyan
$webPorts = 80,443,8080,8443,8000,8888
foreach ($port in $webPorts) {
$listeners = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue
foreach ($l in $listeners) {
$proc = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
$exposure = if ($l.LocalAddress -in @('0.0.0.0','::')) { 'EXPOSED - ALL INTERFACES' } else { "Bound to $($l.LocalAddress)" }
$report += [PSCustomObject]@{ Check = 'Listener'; Detail = "Port $port ($($proc.ProcessName))"; Value = $exposure }
Write-Host "Port $port : $($proc.ProcessName) -> $exposure" -ForegroundColor ($(if ($exposure -match 'EXPOSED') {'Red'} else {'Green'}))
}
}
# 3. Check for host firewall rules restricting management interfaces
Write-Host "`n=== Host Firewall Posture ===" -ForegroundColor Cyan
$rules = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue |
Where-Object { ($_.DisplayName -match 'HTTP|HTTPS|Web|Management|Desigo|Siemens') }
if (-not $rules) { Write-Host "No inbound allow rules matched for web/management — verify segmentation at network layer." -ForegroundColor Yellow }
else { $rules | Select-Object DisplayName, Profile | Format-Table -AutoSize }
# 4. Export report
$report | Export-Csv -Path ".\php2shell_exposure_$(hostname)_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "`nReport exported. Remediate any 'EXPOSED' listeners: bind to loopback/management VLAN or block at firewall." -ForegroundColor Cyan
For Linux-hosted components and gateways:
#!/bin/bash
# php2shell exposure assessment - Linux/embedded components
echo "=== PHP Runtime Inventory ==="
which php php-fpm 2>/dev/null
php -v 2>/dev/null | head -1
rpm -qa 2>/dev/null | grep -i php; dpkg -l 2>/dev/null | grep -i php
echo "=== Listening Web Services and Bind Addresses ==="
ss -tlnp 2>/dev/null | grep -E ':(80|443|8080|8443|8000|8888)\b'
echo "WARNING: 0.0.0.0 or ::: bindings on web ports = broad exposure"
echo "=== Web/PHP processes spawning shells (last 200 audit lines) ==="
ausearch -ts recent 2>/dev/null | grep -E 'php|httpd|nginx' | grep -E 'sh|bash|curl|wget|nc' | tail -20
echo "=== Recently modified files in webroots ==="
find /var/www /srv/www /opt/*/htdocs -type f -mtime -14 2>/dev/null
Remediation
- Consult and track ICSA-26-316-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01) and the corresponding Siemens ProductCERT advisory. Siemens is actively assessing product impact — subscribe to Siemens ProductCERT notifications and re-check the advisory for updated affected/fixed product lists and patch versions.
- Apply PHP runtime updates immediately on any system under your administrative control that bundles PHP. Patch to the fixed PHP releases published by the PHP project on/after the October 21, 2026 disclosure. For vendor-appliance components where you cannot patch independently, escalate to Siemens support for updated firmware/software packages and document the compensating controls below in the interim.
- Enforce network restriction now — this is Siemens' explicit primary guidance and your most effective pre-patch control:
- Place building automation management servers and gateways behind firewalls with deny-by-default inbound rules.
- Restrict web management interfaces to a dedicated management VLAN/segment reachable only from authorized operator workstations or via jump hosts with MFA.
- Eliminate any direct internet exposure of BMS web interfaces. Run an external scan (or check Shodan/Censys for your address space) to confirm.
- Segment OT from IT per Siemens operational guidelines and IEC 62443 zones-and-conduits principles. A compromised IT asset must not have a clean path to building automation servers.
- Hunt before you patch. Run the detection content above against management servers for at least the last 14 days. Unauthenticated RCE flaws in PHP are exploited opportunistically at scale — assume probing began at disclosure and verify no webshells or anomalous child processes exist before declaring a system clean.
- Audit credentials and trust relationships on any host showing signs of probing or compromise: BMS project credentials, controller access accounts, service accounts, and any stored BACnet/OPC UA client configurations.
- Monitor CISA KEV for CVE-2026-109618 and CVE-2026-109619. KEV addition triggers binding remediation deadlines for federal civilian agencies and should trigger emergency change procedures for everyone else.
- Validate backups and recovery procedures for building management servers — including project database exports and controller configurations — so a compromised BMS host can be rebuilt without losing building operational state.
Conclusion
The php2shell disclosure is a textbook example of why OT security programs cannot treat "IT vulnerabilities" as someone else's problem. A flaw in a general-purpose scripting runtime becomes a building-control problem the moment it ships inside a building automation product. Until Siemens completes its product impact assessment and ships fixes, your defense is layered and unglamorous: restrict network access, segment aggressively, hunt for post-exploitation behavior, and be ready to patch on short notice.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.