Siemens Energy and Building Products Hit by Actively Exploited PHP Remote Code Execution Flaws
Our earlier advisory on Siemens RUGGEDCOM APE1808 covered the pair of unauthenticated remote code execution flaws in the core PHP runtime collectively known as php2shell, tracked as CVE-2026-109618 and CVE-2026-109619 and disclosed on 21 October 2026. Siemens has now extended its assessment, and this update covers a far wider slice of the portfolio: the Building Automation and Energy product lines. Newly named as affected are AMIS TS, blueplanet 360 NX3 M6 WM OD IISX and the IISX – S variant, Energy Engage V2.0SP9 and V3.1SP1, Heliox Rapid, Local Monitoring bt-monitoring-vm below V20261103, Spectrum Power 3, Spectrum Power 4, Spectrum Power 7 and Spectrum Power TG. Spectrum Power 3 is listed against CVE-2026-109619 only; the remainder are affected by both issues. Each flaw carries a CVSS v3.1 base score of 9.8 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and maps to CWE-416, Use After Free.
The mechanism is unchanged from the original disclosure but now reaches energy-sector operational systems. CVE-2026-109618 abuses the way PHP uses longjmp() to abandon the current context when an out-of-memory condition occurs. Some contexts fail to account for that abrupt exit and leave request memory uninitialised before performing an allocation, after which the request cleanup routine reads or branches on that memory; several different out-of-memory strategies trigger the condition consistently and lead to code execution. CVE-2026-109619 concerns PHP global state that temporarily points into request memory and is either not reset correctly or repopulated after being reset, leaving the global pointer referring to freed memory. In the Siemens estate the exposure sits in the web and monitoring layers rather than the control logic itself: Spectrum Power 4 deployments running Nagios or Zabbix, those with Web Office Portal V3.0, V3.1 and V3.2 or HISViews V1.0, Spectrum Power 7 using IHM on NagiosXI, and Spectrum Power TG on Microsoft Windows using the WebConsole and WebQuery components.
What separates this round from a routine PHP patch cycle is the fix picture combined with confirmed attacker interest. Both CVE-2026-109618 and CVE-2026-109619 were added to the CISA Known Exploited Vulnerabilities catalog on 26 October 2026, meaning exploitation in the wild is confirmed rather than theoretical, and FIRST EPSS places the probability of exploitation over the next 30 days at 100.0% for each. Siemens has published fixes for only part of the affected set: Energy Engage V3.1SP1 moves to PHP V8.1.34 release 6, Local Monitoring bt-monitoring-vm to V20261103, Spectrum Power TG to PHP V8.5.12, and Spectrum Power 7 using IHM relies on the Red Hat PHP security patch for RHEL 8 and 9. For AMIS TS, both blueplanet 360 variants and the Spectrum Power 4 configurations, no fix is currently available, and for Energy Engage V2.0SP9 no fix is planned at all. Siemens has also stated that its evaluation is ongoing and that findings are subject to change as further technical detail emerges, so the affected list should be treated as provisional. These are energy management, metering and distribution monitoring platforms deployed worldwide, and an unauthenticated attacker reaching an exposed PHP-backed web or monitoring interface would gain code execution on a host that typically sits adjacent to grid-facing systems. With exploitation already observed and a significant portion of the portfolio unpatched, the practical defence for many operators currently rests on network exposure rather than on vendor code.
Attack Surface
Web Application, Infrastructure, Server OS, System Management Service
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Upgrade the bundled PHP runtime on Spectrum Power TG installations on Microsoft Windows that use the WebConsole and WebQuery components to PHP V8.5.12, as directed by Siemens advisory ICSA-26-316-01.
- Update Energy Engage V3.1SP1 to PHP V8.1.34 release 6; note that Energy Engage V2.0SP9 has no fix planned and must be handled by isolation or migration rather than patching.
- Update Local Monitoring bt-monitoring-vm from any build below V20261103 to V20261103 or later, which is the vendor-fixed version for both CVE-2026-109618 and CVE-2026-109619.
- Apply the Red Hat PHP security errata for RHEL 8 and RHEL 9 on Spectrum Power 7 hosts running the IHM component on NagiosXI, then confirm php -v reports the patched build and restart httpd so the new runtime is loaded.
- For products with no available fix – AMIS TS, blueplanet 360 NX3 M6 WM OD IISX and IISX – S, Spectrum Power 4 with Nagios or Zabbix, Spectrum Power 4 with Web Office Portal V3.0, V3.1 or V3.2, and Spectrum Power 4 with HISViews V1.0 – restrict TCP/80 and TCP/443 access to these web interfaces to named engineering workstations or jump hosts using firewall allow-lists, and remove any internet exposure.
- Hunt on affected hosts for signs of php2shell exploitation: php-fpm or httpd child processes spawning cmd.exe, powershell.exe or /bin/sh, abnormal segmentation fault or memory_limit exhaustion entries in PHP error logs, and newly written .php files under Web Office Portal, HISViews, WebConsole or NagiosXI web roots.
- Track updates to Siemens advisory ICSA-26-316-01 and its CSAF feed, as Siemens states its product evaluation is ongoing and the affected product list and remediation status are subject to change.
