← Tuesday 27 Octobernote 7 of 13
CybersecurityTue 27 Oct 2026 · 7 of 13

Industrial Vendors Alert Customers to PHP2Shell Vulnerabilities

Verified · 9/9 supported1 cited · 1 min read

securityweek.com reports that industrial vendors Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have confirmed that some of their OT products are affected by the PHP2Shell vulnerabilities . securityweek.com reports that PHP2Shell refers to CVE‑2026‑109618 and CVE‑2026‑109619, two critical unauthenticated remote code execution flaws in the PHP engine . securityweek.com reports that PHP released patches on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after a leak of the vulnerabilities . securityweek.com reports that the first exploitation attempt was observed on October 17, before the patches, and Cloudflare has reported millions of attempts, with the first confirmed attacks aimed at honeypots reported over the weekend . securityweek.com reports that Schneider Electric identified three affected products—EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering—while other vendors are still assessing exposure or have determined no impact .

Why it matters. securityweek.com reports that customers of the affected vendors need to apply the October 21 patches to mitigate the remote code execution risk . securityweek.com reports that ongoing assessments mean some customers may still be uncertain about the safety of their products .

Earlier on Cybersecurity

Sat 24 Oct 2026Mirai Botnet Targets Newly Patched PHP2Shell Vulnerabilitiessecurityweek.com reports that researchers linked PHP2Shell attack attempts to the Mirai botnet and demonstrated an ASLR bypass, but no successful in‑the‑wild compromise has been confirmed. securityweek.com reports that emergency patches for the PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) were released on October 21, one day earlier than planned after the CVE identifiers leaked online. securityweek.com reports that the two critical bugs allow unauthenticated remote code execution and have a CVSS v4.0 score of 9.2. securityweek.com reports that precautionary shutdowns affected many organizations, with European government, school and hospital websites going dark on October 21 and the UK government reporting 32 services unavailable and four partially unavailable. securityweek.com reports that Amazon detected the first exploitation attempt on October 17, that attack activity surged after the patches were released, and that a security firm built an exploit that bypasses a key memory protection (ASLR).Sat 24 Oct 2026Self‑Rebuilding Heartbreaker macOS Ransomware Remains Undetectedsecurityweek.com reports that Heartbreaker is a Rust‑based macOS ransomware sample that was uploaded to VirusTotal in May 2025. securityweek.com reports that the malware remains undetected by every antivirus engine on VirusTotal as of the report. securityweek.com reports that it attempts to establish persistence via a LaunchAgent before encrypting files in the user’s Downloads folder. securityweek.com reports that Heartbreaker tries to change its hash by extracting its embedded source code, randomizing identifiers, adding junk functions, and recompiling itself, even attempting to install Rust if missing. securityweek.com reports that researcher Patrick Wardle believes the ransomware is unlikely to become a major threat because it uses a single hardcoded AES key that allows free file recovery.Fri 23 Oct 2026Corey Thuen’s “evil bit” hiring philosophy at Gravwellsecurityweek.com reports that Corey Thuen is the founder and CEO of Gravwell, a firm that develops data analytics and vulnerability detection using big data experts and hackers. securityweek.com reports that Thuen hires hackers based on an “evil bit,” an adversarial mindset that can identify ways to exploit products. securityweek.com reports that he believes the “evil bit” is largely innate and not easily taught. securityweek.com reports that Thuen previously worked for the US government evaluating systems in power substations, part of critical infrastructure. securityweek.com reports that he references the old‑school hacking ethos that all information should be free and questions who defines morality.
Next · Climate techGermany’s GICON unveils 300‑m wind turbine as Max Bögl installs 199‑m rival →