Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

Siemens RUGGEDCOM APE1808 affected by PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619

Siemens lists its RUGGEDCOM APE1808 as affected by two PHP2Shell use-after-free flaws, CVE-2026-109618 and CVE-2026-109619, through the Palo Alto Networks PAN-OS component. The advisory says the flaws can lead to remote code execution and that Siemens reported them to CISA.

SZB-082f439dadPending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources13Confirmed
Kind
Pending CVE
Vendor
Check Point
Product
Check Point security gateways
Attacker tool
PHP2Shell, PhiliKit, TSGA
Threat actor
UNC5221
Status
Confirmed
First seen
Confirmed

What to do

  • Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version.

  • Contact Siemens customer support for additional patch and update information.

  • Follow the workarounds in Palo Alto Networks' upstream notifications until patched.

  • Restrict network access to the devices.

  • Apply the vendor fixes where Siemens has released them, such as Energy Engage V3.1SP1 upgrades.

  • Apply the mitigations Siemens recommends for products with no fix yet available.

Timeline

  1. Made public by CISA advisories
  2. First seen by cve.now
  3. Confirmed by CISA advisories1 day
  4. Record last updated

Evidence 13

  1. Official
    CISA advisories
    “Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities.”
  2. Official
    CISA advisories
    “On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619).”
  3. Press
    Catalin Cimpanu on Bluesky
    “Check Point says hackers are exploiting PHP2Shell to take over its security gateways”
  4. Social
    Mastodon
    “Check Point Gateway vulnerability CVE-2026-123039 exploited with PHP2Shell to gain root, plant backdoors and wipe ESXi.”
  5. Social
    Mastodon
    “Angreifer haben eine Schwachstelle im Gaia-Betriebssystem von Check Point bei einigen Dutzend Kunden ausgenutzt.”
Show all 13 sourcesShow fewer sources
  1. Social
    Mastodon
    “Check Point observed an active exploit of this vulnerability against a couple of dozen customers.”
  2. Press
    SecurityWeek
    “Threat actors have been exploiting PHP2Shell vulnerabilities to hack Check Point Gateway appliances and deploy a wiper against victim organizations, Check Point reports.”
  3. Press
    The Hacker News
    “An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.”
  4. Press
    BleepingComputer
    “Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October.”
    +1 more: BleepingComputer on Bluesky
  5. Social
    Bluesky
    “Check Point warns of zero-day flaw exploited for root access”
    +3 more: Bluesky, Bluesky, Bluesky
  6. Social
    Bluesky
    “CVE-2026-123039 (7.8) — portal shell to root via world-writable socket. Actively exploited.”
  7. Social
    Mastodon
    “A newly documented intrusion campaign targeting Check Point security gateways demonstrates how compromising a perimeter appliance can lead to full infrastructure compromise.”
  8. Social
    Bluesky
    “Check Pointが、root権限奪取と永続化を可能にするゼロデイ脆弱性について警告。既に10月後半から悪用されている。”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-082f439dad

Has Check Point confirmed it?

Yes. Confirmed by CISA advisories.Source: CISA advisories, CISA advisories, Catalin Cimpanu on Bluesky, Mastodon, Mastodon, Mastodon, SecurityWeek, The Hacker News, BleepingComputer, Bluesky, Bluesky, Mastodon, Bluesky

What should Check Point and Check Point Gateway users do?

Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version. Contact Siemens customer support for additional patch and update information. Follow the workarounds in Palo Alto Networks' upstream notifications until patched. Restrict network access to the devices. Apply the vendor fixes where Siemens has released them, such as Energy Engage V3.1SP1 upgrades. Apply the mitigations Siemens recommends for products with no fix yet available.

Does it have a CVE?

Yes. It is tracked as CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.Source: CVE-2026-109618, CVE-2026-109619, CVE-2026-123039

Sources

Tracked as