PHP Project and Siemens Disclose Two Critical Vulnerabilities

Key points

• Two CVEs affect the PHP runtime plus Siemens building automation and energy products.
• The flaws allow code execution by an unauthenticated attacker.
• Disclosure occurred October 21, 2026; impact monitoring continues.
• Admins should segment networks and harden IT configurations.

PHP project maintainers and security researchers have disclosed information on two critical flaws, CVE-2026-109618 and CVE-2026-109619. A bulletin from 21 October 2026 addresses the PHP runtime as well as Siemens’ building automation and energy offerings. Each vulnerability is classified as critical since it permits remote code execution without requiring authentication beforehand.

Affected organizations include anyone running the PHP runtime in exposed services and operators of Siemens building controls or energy platforms. In K-12 districts, those systems can include HVAC, access control, and energy management components that often share network paths with administrative systems. The PHP project and Siemens are monitoring the impact while urging customers to reduce exposure.

At this stage, the practical risk is highest where affected services are reachable from the internet or from untrusted network segments. The vendors' guidance centers on network protection and a protected IT configuration, meaning defenders should limit access, apply available mitigations, and review segmentation around building and energy systems. The two CVEs should be treated as urgent patching and verification items rather than routine maintenance.

Because exploitation does not require a valid account, internet-facing PHP runtime instances and unsegmented Siemens deployments deserve immediate attention. IT teams should inventory affected assets, confirm which services are exposed, and watch for vendor updates and signs of anomalous activity. The situation is still developing; the key unknowns are patch availability and whether exploitation has been observed.

What to do now

1. Inventory all PHP runtime instances and Siemens building automation/energy assets; flag any reachable from the internet or untrusted VLANs.
2. Apply vendor mitigations or patches as soon as available; if none exist, disable or isolate exposed services.
3. Enforce network protection: block inbound access to affected services, restrict management interfaces, and segment building/energy systems from user and admin networks.
4. Harden IT configuration: remove default accounts, enforce least privilege, enable logging, and back up configurations before changes.
5. Monitor impact: review logs for unusual process creation, outbound connections, or authentication anomalies on affected hosts.
6. Coordinate with facilities/OT owners; validate that Siemens controls are not directly internet-facing.
7. Track CVE-2026-109618 and CVE-2026-109619 advisories and re-scan after patching.

CVE references

• CVE-2026-109618
• CVE-2026-109619

Original source

CISA Advisories