Industrial networking equipment running integrated firewall software faces severe security risks following the disclosure of two memory management flaws. The Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory alerting critical manufacturing operators to remote code execution vulnerabilities affecting Siemens RUGGEDCOM APE1808 devices that host Palo Alto Networks PAN-OS.

According to the CISA advisory, the issues stem from upstream PHP2Shell vulnerabilities identified in the PAN-OS platform. The most severe flaw carries a critical Common Vulnerability Scoring System (CVSS) base score of 9.8, allowing unauthenticated network attackers to achieve arbitrary code execution without user interaction.

Memory Management Errors Lead to Remote Code Execution

The reported security defects are classified as use-after-free vulnerabilities (CWE-416) within PHP execution handling. Both issues allow attackers to manipulate memory states during request processing, causing the application to execute arbitrary commands.

The primary vulnerability, designated as CVE-2026-109618, involves how PHP handles out-of-memory (OOM) scenarios. PHP relies on the longjmp() function to terminate the current execution context and abort incoming requests when memory limits are reached. In affected PAN-OS contexts, the system fails to account for this exit process properly, leaving request memory uninitialized before attempting further allocations. When cleanup routines subsequently read from or branch on this uninitialized data, attackers can trigger repeatable memory corruption strategies to gain remote code execution.

The second flaw, tracked as CVE-2026-109619, holds a high-severity CVSS score of 8.1. This bug arises because PHP maintains global state variables that temporarily point into request-specific memory. Under certain conditions, this global state is either not cleared correctly or becomes repopulated after a reset. The global state then continues pointing to freed request memory. Subsequent incoming requests that read or branch on this stale, partially initialized state can be weaponized through various input sequences to yield remote code execution.

Affected Products Across Industrial Environments

Siemens RUGGEDCOM APE1808 (Application Processing Engine) modules are ruggedized PC devices designed to run network applications, including third-party firewalls, directly inside industrial-grade modular switches and routers. These modules are widely deployed worldwide within the critical manufacturing sector.

All versions of the Siemens RUGGEDCOM APE1808 hardware running affected Palo Alto Networks PAN-OS software streams are vulnerable. Specifically, the advisory lists the following PAN-OS versions installed on APE1808 as affected:

  • PAN-OS 10.2 (all versions)
  • PAN-OS 11.1 (all versions)
  • PAN-OS 11.2 (all versions)
  • PAN-OS 12.1 (all versions)
  • PAN-OS 12.2 (all versions)

The vulnerabilities were originally addressed in upstream Palo Alto Networks notifications and subsequently reported to CISA by Siemens ProductCERT.

Vendor Response and Upstream Remediations

Siemens ProductCERT released operational guidance and republished details in coordination with CISA to ensure industrial facilities address the software flaws. To resolve both vulnerabilities, administrators must upgrade the underlying Palo Alto Networks PAN-OS installations on the APE1808 modules to an available, fixed release.

Siemens advises organizations needing update packages or further patch guidance to consult Palo Alto Networks' upstream security notifications and contact customer support teams for platform-specific deployment instructions.

What You Should Do

Security teams and operational technology (OT) engineers managing RUGGEDCOM hardware should immediately audit their deployed modules and apply the following defensive measures:

  • Upgrade PAN-OS software: Apply the corresponding upstream Palo Alto Networks updates across all APE1808 units to eliminate the underlying PHP2Shell memory flaws.
  • Eliminate direct internet exposure: Ensure all industrial control systems, management consoles, and RUGGEDCOM computing modules are removed from direct exposure to the public internet.
  • Enforce network segmentation: Isolate control system networks and perimeter devices behind dedicated firewalls, separating them completely from general enterprise IT business networks.
  • Secure administrative remote access: Route necessary remote connections through patched virtual private networks (VPNs) and maintain strict access controls, remembering that perimeter defenses depend directly on the security of connected endpoints.
  • Follow industrial guidelines: Review Siemens operational guidelines for industrial security and execute pre-deployment impact analyses before applying updates in production environments.