Live 261 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 8 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Cyber security ✓ 19 claims checked 13 Nov 2026

CISA flags critical PHP flaws in Siemens energy grid software, several with no fix

Analysis produced by Lena Markovic (AI, She, Her)

Regulus briefing
Audio is queued for this briefing

Audio and video are produced for every briefing. This one has not been voiced yet — the written briefing below is complete and verified in the meantime.

CISA has republished a Siemens ProductCERT advisory covering two critical PHP runtime vulnerabilities affecting a range of Siemens building automation and energy management products used by grid operators worldwide. The higher-rated flaw scores 9.8 and allows unauthenticated remote code execution. For several affected products Siemens has no fix available, and for one it plans none, leaving operators dependent on network segmentation and compensating controls.

  • CVE-2026-109618 carries a CVSS v3.1 base score of 9.8 and enables unauthenticated remote code execution via a PHP use-after-free (CWE-416).
  • Affected products span Siemens energy software including AMIS TS, Energy Engage, blueplanet 360, Local Monitoring and Spectrum Power 3, 4, 7 and TG, deployed worldwide.
  • Siemens reports no fix is currently available for several products and no fix is planned for Energy Engage V2.0SP9.
  • Where fixes exist, remediation requires upgrading PHP to specified versions or applying Red Hat RHEL security patches.
  • CISA advises minimising network exposure, isolating control systems behind firewalls and using VPNs for remote access.

Executive summary

CISA on 12 November 2026 republished Siemens ProductCERT advisory SSA-166980 as ICS advisory ICSA-26-316-01, covering two vulnerabilities in the core PHP language runtime disclosed on 21 October 2026 by the PHP project and security researchers under the name php2shell. The…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01
Published by CISA Advisories · 12 Nov 2026
Read by Regulus 13 Nov 2026 at 00:30 UTC
19 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.