Johnson Controls Illustra

CVE-2026-109618 / CVE-2026-109619, PHP2Shell in industrial, building and network-access products: Belden NetModule NRSW has no fix and macmon 6.x must move to 7.x, with notices from Schneider Electric, B&R, HMS Networks, Wibu-Systems, Johnson Controls and Oracle

Industrial, building and network-access vendors have published their own notices for the PHP runtime flaws CVE-2026-109618 and CVE-2026-109619, which CISA lists as exploited since 2026-10-26 (CISA KEV, 2026-10-26). Belden says all versions of NetModule NRSW, including the latest mainline release 5.0.0.104, are affected and that no patched release exists; until one ships it advises disabling the web interface after confirming SSH access, with the CLI settings http.status=0 and https.status=0 (Belden, 2026-10-22). NetModule AG is headquartered in Bern, Switzerland (Belden, 2022-03-14). Belden's macmon 6.x and 7.x use PHP in the web interface: a patch for 7.x is in the service portal, 6.x must move to 7.x, and the HTTPS web interface and guest portal must not be reachable from the internet unprotected (Belden, 2026-10-22).

Schneider Electric lists EcoStruxure Security Expert (fixed in 1.48.4.0), ProLeiT LINEoptimize (remediation through ProLeiT support) and EcoStruxure Control Engineering, where its revision of 2026-10-26 gives an automatic update if the hosting virtual machine can reach the debian.org and sury.org repositories and a Schneider patch otherwise (Schneider Electric, 2026-10-26; SecurityWeek, 2026-10-26). B&R says APROL up to R 4.4-65 is affected, with patches planned for 2026-10-26 and 2026-10-29 (B&R, 2026-10-23). HMS Networks says Netbiter firmware up to 3.00.10 can be exploited from the LAN or the USB port and that 3.00.11 fixes it (HMS Networks, 2026-10-23). Wibu-Systems lists the web interface of CodeMeter License Central and its extensions, with 5.2.2 released and a patch installer for 5.1.2 and 5.0.x (Wibu-Systems, 2026-10-23). Johnson Controls has released patches for several Illustra product lines and fixed Visonic PowerManage in 5.0.45 (SecurityWeek, 2026-10-26). Oracle's Security Alert, revised on 2026-10-26, patches Oracle Secure Backup 19.1.0.0.0 to 19.1.0.1.0, Oracle Solaris 11 and eight Oracle Communications products for CVE-2026-109618 (CVSS 3.1 9.8) and says it will extend the alert as more patches become available (Oracle, 2026-10-26).

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto: eleven PAN-OS hotfixes for PHP2Shell are out, nine still due by 30 October; CISA now… · NetScaler management GUI is affected by PHP2Shell, now on CISA KEV; fixes due 2026-10-27… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and…