Securityweek Siemens Warns of Critical Vulnerabilities in RUGGEDCOM APE1808 Devices
Article Content
- •Two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affect Siemens RUGGEDCOM APE1808 devices.
- •Exploitation of these vulnerabilities has been confirmed in the wild, posing a significant risk to critical manufacturing.
- •Siemens advises implementing mitigations as patches are not yet available for all affected products.
Siemens has issued advisories regarding critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting the RUGGEDCOM APE1808 device, which is widely deployed in critical manufacturing sectors. These vulnerabilities, related to the PHP2Shell exploit, allow for arbitrary code execution and have been confirmed to be in the wild. The vulnerabilities were published on October 21, 2026, and were added to CISA's Known Exploited Vulnerabilities (KEV) list on October 26, 2026. Siemens recommends that users implement workarounds and secure their network access to mitigate risks. Patches are not yet available for all affected versions, leaving systems vulnerable. Organizations are urged to follow Siemens' operational guidelines for industrial security.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Hitachi Energy and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs associated with this vulnerability?
What should organizations do to protect their systems?
Are patches available for these vulnerabilities?
Continue Reading
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…