If you run Windows servers, Active Directory or a Microsoft 365 estate behind Palo Alto firewalls, this is the sort of edge-device problem that decides whether your Patch Tuesday work matters at all.
What Siemens says is affected
The product is the RUGGEDCOM APE1808. Siemens describes it as a utility-grade platform for hosting commercial applications, including edge-computing and cybersecurity applications, in harsh industrial environments. Siemens lists all APE1808 versions running Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 as affected.
Two points are easy to misread:
- The condition is the PAN-OS release family on the box, not the APE1808 hardware alone. An APE1808 that doesn't run PAN-OS isn't covered by this advisory's wording.
- Siemens gives no sub-version ranges and no single APE1808 firmware fix. Its remediation is to upgrade to the corresponding available PAN-OS version and to contact customer support for patch and update details.
The two vulnerabilities
Both are use-after-free flaws (CWE-416) in PHP that can lead to remote code execution.
| CVE | Mechanism | CVSS v3.1 | CVSS v4.0 |
|---|---|---|---|
| CVE-2026-109618 | Out-of-memory handling uses longjmp() to abort a request and can leave request memory uninitialised. Cleanup then reads or branches on it. | 9.8 Critical (attack complexity low) | 9.2 |
| CVE-2026-109619 | Global state that points into request memory isn't reset correctly, or is repopulated. It then points at freed memory, and a later request acts on the stale state. | 8.1 High (attack complexity high) | 9.2 |
Both v3.1 vectors show network attack, no privileges and no user interaction. The difference in the v3.1 scores comes down to attack complexity. These are scoring metrics, not evidence that any particular device has been compromised.
Why the Palo Alto context matters
Siemens' advisory is a downstream notice. The real action is upstream.
- PHP fixes. Help Net Security reported that PHP shipped emergency fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PAN-OS bundles PHP for its management web interface. Cyber Kendra reports that Palo Alto says the flaws are reachable only through that interface, meaning the HTTPS web UI and the XML API.
- Active exploitation. Cybersecurity News reports that Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. The same report says Palo Alto put the affected share at roughly 0.02% of its global installed base, meaning devices with public management interfaces.
- KEV listing. SOCRadar says the flaws were added to CISA's KEV catalog on October 26, 2026.
- Fixes exist now. Early coverage said PAN-OS had no fix. That is out of date. ThreatDefence reports that every PAN-OS hotfix has shipped.
Palo Alto's own advisory, updated October 29, lists the fixed PAN-OS builds. Examples include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13. Its FAQ says one hotfix covers both CVEs, and that 11.2.10-h16 is the exception: it fixes PHP but not the brotli issue that 11.2.10-h17 also covers.
One caution. Siemens did not publish a fixed-build list for the APE1808. Palo Alto's list tells you what the PAN-OS branches need. It doesn't tell you what Siemens has validated for this hardware. Don't assume the two line up. Ask Siemens support.
Nothing in the Siemens advisory says APE1808 devices have been attacked. The exploitation reporting concerns PAN-OS management interfaces generally.
What administrators should do
- Find out whether the APE1808 is running PAN-OS. If it is, identify the release family. Anything on 10.2, 11.1, 11.2, 12.1 or 12.2 is in Siemens' affected scope.
- Check exposure first. Palo Alto says the risk is highest when the management interface is reachable from external IP addresses on the internet. Its recommended mitigation is to restrict that access to a single jump box or to trusted internal addresses. The Palo Alto advisory also lists a Threat Prevention route for customers with the subscription. It requires routing management traffic through a data-plane interface, decrypting it and enabling threat prevention on it.
- Upgrade through the vendor path. Contact Siemens support for APE1808-specific patch details. Use Palo Alto's version table as a reference for the PAN-OS branch, not as a replacement for that confirmation.
- Treat exposed devices as possibly compromised. If a management interface was ever internet-facing during late October, look for signs of intrusion. Follow your internal incident procedures and report suspicious activity to CISA, as its advisory recommends.
- Apply CISA's general ICS guidance. Keep control-system devices off the internet, put them behind firewalls and isolate them from business networks. If you need remote access, use VPNs, keep them current and remember a VPN is only as secure as the devices connected to it.
Network isolation is defence in depth. It is not a substitute for the upgrade. Siemens doesn't say isolation alone remediates either CVE.
The bigger picture
PHP2Shell is a reminder that appliances are software stacks. A firewall's web UI is a web application with all the memory-safety baggage that implies. For mixed Windows and OT environments, the lesson is practical:
- Inventory edge and OT-adjacent devices with the same rigour as domain controllers.
- Never leave management planes on the internet.
- Track upstream vendor advisories, because Siemens, Cisco and others inherit them.
There is a fair counterpoint on severity. Palo Alto scored the product impact at CVSS 9.2 and says exposure is concentrated in internet-facing management interfaces. A properly segmented APE1808 is a much harder target than the headline score suggests. But "properly segmented" is the part you have to verify, not assume.