Node2Shell and PHP2Shell in Siemens OT Products: Five CISA Advisories (ICSA-26-316-01 to -05)

The short version

On November 12, 2026, CISA republished five Siemens advisories, ICSA-26-316-01 to -05. They trace back to two open-source library bugs. The first is CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder that Siemens calls Node2Shell (CVSS v3.1 9.8). The second is a pair of PHP use-after-free flaws, CVE-2026-109618 (9.8) and CVE-2026-109619 (8.1), that Siemens calls PHP2Shell. All three allow remote code execution without authentication, and all three are in the CISA Known Exploited Vulnerabilities catalog.

The two libraries reach a wide range of Siemens products: Spectrum Power energy management systems, Desigo CC building automation, Gridscale X, Industrial Edge applications, and the RUGGEDCOM APE1808, the ruggedized platform that runs a Palo Alto Networks PAN-OS firewall inside the plant. Several products have no fix, and one has no fix planned.

For those servers, the control is who can reach them. Take them off the flat network, allow named users on the ports they need, and record the sessions until Siemens ships a fix.

What the advisories say

Each CISA advisory republishes a Siemens ProductCERT advisory (SSA) first released between October 23 and October 30, 2026.

Siemens also lists CVSS v4.0 scores of 9.2 for these CVEs in its own advisories.

The PHP products in ICSA-26-316-01, product by product:

The Brotli fixes in ICSA-26-316-02 and -03. Desigo CC V8 and V9 are fixed by installing the latest .NET security updates through Windows Update. Gridscale X DSA goes to V5.4 and Gridscale X PSS®E to V36.8.0. On Industrial Edge, Cloud Connector Configurator goes to V1.24.3, Data Flow Monitoring to V3.0.18, Databus Configurator to V4.0.1, DataXess Configurator to V1.5.7, Edge OPC UA Server Configurator to V2.3.10 and Flow Creator Configurator to V1.15.1. Siemens fixed Industrial Edge Hub and Industrial Edge Management Cloud on its side, with no user action needed.

Common Configurator has no fix. For Common Configurator on IEM, Siemens says to uninstall all management applications and protect the IEM instance with a firewall or WAF. For Common Configurator on Device, it says to stop the application. If no management applications are installed, Siemens says no action is required, because the Brotli library is present but not used. We covered an earlier, unrelated IEM flaw in the Industrial Edge Management password reset post.

Sectors. CISA lists Energy for ICSA-26-316-01, Critical Manufacturing, Energy and Information Technology for -02, and Critical Manufacturing for -03, -04 and -05. All are deployed worldwide.

Exploitation status

The two libraries were patched upstream in late October. PHP shipped 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026, and CISA issued an alert the same day urging immediate patching. The Brotli fix is in 1.0.10, 1.1.1 and 1.2.1, per the advisories.

CISA added CVE-2026-109618 and CVE-2026-109619 to KEV on October 26, 2026, and CVE-2026-111497 on October 27, 2026. The catalog was at version 2026.11.10 when we checked on November 12.

Palo Alto Networks reports active exploitation of the PHP flaws against PAN-OS management interfaces exposed to the internet. It says it is not aware of malicious exploitation of the Brotli flaw in its products. None of the five Siemens advisories reports exploitation of a Siemens product.

How the flaws reach an OT network

PHP2Shell is a web server problem. The flaws sit in how PHP handles a request that runs out of memory, and in state that survives from one request to the next. PHP's advisory for CVE-2026-109618 confirms Apache mod_php is exploitable over HTTP with default settings. In Siemens products, PHP runs the web front ends: monitoring consoles built on NagiosXI or Zabbix, the Spectrum Power 4 Web Office Portal, and the PAN-OS management interface and XML API. Anyone who can send HTTP requests to those pages can attempt the exploit.

Node2Shell is a decompression problem. Any service that decodes a Brotli stream from an untrusted sender can be hit with a crafted stream. On the APE1808, Palo Alto says the exposure is narrower: only firewalls that inspect Brotli traffic with TLS decryption on the dataplane are exposed, the management interface is not affected, and PAN-OS 10.2 and 11.1 are not affected. Brotli encoding is off by default in PAN-OS 11.2.4 and later, so a firewall is exposed only if someone turned it on. The workaround is to disable it.

The table maps the flaws to MITRE ATT&CK for ICS. It describes what the flaws allow, plus the PAN-OS exploitation Palo Alto has reported. It does not describe an observed attack on a Siemens product.

Why this keeps happening

Industrial software is built from the same libraries as web software. PHP and Brotli are everywhere on the internet, so when one breaks, the fix ships fast for web servers. It reaches an energy management system or a building automation server much later, because each vendor has to find the library, rebuild, test and release. Siemens published its advisories within ten days of the PHP fixes. Three weeks after those fixes, some of its products still have none.

The firewall is on the list too. The RUGGEDCOM APE1808 exists to run a firewall close to the equipment. Per Palo Alto, the PHP flaws reach the PAN-OS management web interface and XML API, so the APE1808 inherits PHP2Shell. We made the same point about the FortiOS variant in the APE1808 FortiOS post. A security appliance has its own advisories, so it should not be the only thing protecting a segment.

Patching OT servers takes time. A Spectrum Power update in a control center needs testing and a maintenance window. Our post on patch management in operational environments covers why. When there is no fix at all, the window does not exist yet.

What to do, whatever you run

Find the libraries. List every Siemens product from the five advisories, then ask which other servers in your plants run PHP or decode Brotli. CISA's PHP alert asks for an inventory of PHP embedded in other software, not just web servers.

Patch where a fix exists. That covers Desigo CC, Gridscale X, most Industrial Edge applications, Spectrum Power 3, 7 and TG, Energy Engage V3.1SP1 and bt-monitoring-vm. On the APE1808, Palo Alto lists fixed hotfixes per PAN-OS branch. Note that 11.2.10-h16 fixes PHP only, while 11.2.10-h17 fixes both.

Lock down the PAN-OS management interface. Palo Alto's guidance is to limit management access to trusted internal addresses or a single jump host. Check whether any dataplane interface has a management profile attached, because that exposes the web UI there too.

Contain what you cannot patch. For AMIS TS, blueplanet, Spectrum Power 4 and Energy Engage V2.0SP9, restrict the web front end to the named operators and systems that use it. Keep it off the internet and off the business network. Stop or uninstall Common Configurator, as Siemens advises.

How Access Gate helps, and its limits

Access Gate is an appliance installed at each site. It connects beside your existing network. One route on the current router then steers traffic to the servers you choose through it. Nothing is installed on the Siemens server. It is installed in a day per site. The Lollipop architecture post explains the design.

A per-server rule decides who reaches each web front end. Access control lists are default deny. One rule lets the control room workstations reach the Spectrum Power 4 Web Office Portal over HTTPS. Every other host gets no route, which removes most of the senders that could deliver a PHP2Shell request.

A named person signs in first. An access screen asks for a directory login before a workstation reaches the server. Access expires after 15 minutes, 1 hour or 8 hours.

Admin sessions are tied to a name. With privileged access management, RDP and SSH to the server and HTTPS to admin web interfaces, such as the PAN-OS or IEM consoles, open in a browser session tied to a named person and limited in time. RDP and SSH sessions are recorded. Every rule change lands in the enclave change history.

The limits are real. Access Gate does not patch PHP or Brotli, and it does not detect these CVEs. An allowed user can still send a malicious request to a server it is allowed to reach. Access Gate does not change what the APE1808 firewall decodes on its own dataplane, so disabling Brotli encoding or upgrading PAN-OS is still the answer there. The fixes from Siemens and Palo Alto remain the fixes. See also OT identity, secure remote access and power grid.

What to do this week

1. List every product from the five advisories, with its version and the SSA that covers it.
2. Check the KEV entries for CVE-2026-109618, CVE-2026-109619 and CVE-2026-111497, and set priority accordingly.
3. Test whether any PAN-OS management interface answers from the internet or the business network.
4. Run show system setting brotli on each APE1808 on PAN-OS 11.2.4 or later, and disable Brotli encoding if you cannot upgrade yet.
5. Apply the available fixes on Desigo CC, Gridscale X, Industrial Edge, Spectrum Power 3, 7 and TG.
6. Stop or uninstall Common Configurator on IEM and on devices.
7. Restrict every unpatched PHP server to named users and recorded admin sessions.

Want to see where a gate would sit in your plant? Build your network in a few minutes. Every other advisory we have covered is in the ICS security advisories archive.

Sources: CISA ICS Advisories ICSA-26-316-01, ICSA-26-316-02, ICSA-26-316-03, ICSA-26-316-04 and ICSA-26-316-05 (November 12, 2026); Siemens ProductCERT SSA-166980, SSA-045512, SSA-443410, SSA-898633 and SSA-566512; Palo Alto Networks advisories for CVE-2026-109618 and CVE-2026-111497; the PHP advisory GHSA-w8hw-w9fx-j79w; the Brotli v1.2.1 release; the CISA PHP alert; the CISA Known Exploited Vulnerabilities catalog, version 2026.11.10, checked November 12, 2026; and MITRE ATT&CK for ICS. Confirm affected versions and update steps with Siemens and Palo Alto Networks before changing a production system.