Node2Shell and PHP2Shell Flaws Hit Siemens Industrial Gear

Neither flaw started in Siemens code. Both sit in components its products depend on:

• Node2Shell (CVE-2026-111497): an out-of-bounds write in the Brotli decoder bundled with Node.js that may allow remote code execution. Node.js fixed it on October 21, 2026.
• PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two unauthenticated RCE flaws in the PHP runtime, disclosed on October 21, 2026.

Affected products per CISA

• Desigo CC (V8, V9) and Gridscale X: affected by Node2Shell; Siemens has released new versions.
• RUGGEDCOM APE1808: affected by both through the Palo Alto PAN-OS it runs; apply Palo Alto's guidance.
• Building automation and energy products such as AMIS TS: affected by PHP2Shell.
• Industrial Edge Management: Siemens is still assessing Node2Shell. No action is needed without management apps installed; otherwise apply the mitigations until a fix ships.

What to do

1. Check whether you run any listed Siemens product and apply the update or workaround from its CISA advisory.
2. Validate updates before production rollout, under trained staff supervision, as Siemens advises.
3. Never expose ICS interfaces to the internet; keep them behind firewalls on segmented networks.