[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-energy-software-exposed-to-critical-php-flaws":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},12961,"siemens-energy-software-exposed-to-critical-php-flaws","Siemens Energy Software Exposed to Critical PHP Flaws","Two critical PHP flaws affect Siemens energy and building software, and several products have no fix yet, so network controls are the stopgap.","Operators of Siemens energy and building automation software should check whether their products run an affected version of PHP, because several have no fix and one has none planned.\n\nThe flaws, nicknamed \"php2shell\" and tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21 by the PHP project and security researchers. Both allow unauthenticated remote code execution in the PHP runtime, meaning an attacker over the network can run commands without logging in. The advisory rates the first at 9.8 out of 10 on the CVSS scale, with no user interaction required.\n\nThe first bug involves how PHP handles running out of memory. It abandons the current request using a C function called longjmp(), and some code paths can leave memory uninitialized before the cleanup step reads it. The second involves global state that keeps pointing at request memory after it has been freed.\n\nThe affected list is long: AMIS TS, blueplanet 360 NX3 M6 WM OD IISX (and its -S variant), Energy Engage, Heliox Rapid, the bt-monitoring-vm local monitoring product, and the Spectrum Power 3, 4, 7 and TG lines. The advisory lists the energy sector as the affected critical infrastructure.\n\nFixes are uneven:\n\n- **Available:** Energy Engage V3.1SP1 needs PHP V8.1.34 release 6. The bt-monitoring-vm product needs V20261103 or later. Spectrum Power TG needs PHP V8.5.12. Spectrum Power 3 and 7 setups running NagiosXI rely on Red Hat's PHP patches for RHEL 7, 8 and 9.\n- **Not available:** AMIS TS, both blueplanet products and the Spectrum Power 4 variants.\n- **Not planned:** Energy Engage V2.0SP9.\n\nThe pattern matters more than any single product. The bug sits in a component Siemens did not write, so the fix often depends on a third party, such as Red Hat or the PHP project, and on each product's integration. For the unfixed products, Siemens points to its standing advice: restrict network access to devices and follow its operational guidelines. For a bug reachable over the network with no login, that advice is the only barrier.\n\nSiemens said its assessment is ongoing and the findings may change. The list of affected products may not be final.","[\"php\",\"siemens\",\"ics-security\",\"vulnerability\"]","2026-11-12T12:00:00.000Z","2026-11-12T17:42:19.834Z","2026-11-12T17:42:22.135Z","published",null,[],"security",[26,27,28,29],"php","siemens","ics-security","vulnerability",[31],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-01",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",7151,"2026-11-13T11:05:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",1132,"2026-11-12T15:35:00.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Deals","deals",653,"2026-11-13T11:52:26.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",621,"2026-11-12T19:54:30.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Consumer Tech","consumer-tech",370,"2026-11-12T17:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",337,"2026-11-12T15:31:12.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",232,"2026-11-13T12:00:40.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",172,"2026-11-13T11:04:24.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Startups","startups",160,"2026-11-12T17:31:47.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",120,"2026-11-13T11:33:19.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",109,"2026-11-13T10:00:00.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]