Node2Shell / PHP2Shell: Siemens, Schneider Electric, Phoenix Contact and other ICS vendors — November 2026 ICS Patch Tuesday advisories for code-execution flaws
Severity: high · Patch status: partial · Since 2026-11-11
Siemens, Schneider Electric and other industrial vendors published pre-Patch Tuesday ICS advisories. Siemens issued nine advisories covering 10 vulnerabilities, including two on the Node2Shell vulnerability, which has seen exploitation attempts in the wild (not specifically against Siemens products), plus high-severity flaws in ROS, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA/PCS 7, Meta-iot2050 and Simatic WinCC Graphics Designer enabling code injection, arbitrary code execution, unauthorized data access and system compromise. Patches are not yet available for several affected products and some versions will not receive fixes. Schneider Electric disclosed a medium-severity arbitrary code execution flaw in EcoStruxure Power Build Rapsody. VDE CERT published eight advisories covering Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender and Ads-Tec products, several involving third-party PHP components (PHP2Shell). Phoenix Contact, Johnson Controls and Hitachi Energy also published advisories, with Hitachi Energy confirming at least one product affected by PHP2Shell.
What to do
- Apply Siemens mitigations immediately where patches are unavailable, and prioritize internet-exposed Simatic SCADA/PCS 7 and WinCC systems
- Check whether Hitachi Energy, Phoenix Contact and other OT products embed PHP components affected by PHP2Shell and apply vendor fixes
- Patch Johnson Controls C•CURE 9000/Victor installer issues and rotate any admin credentials or authentication secrets that could have been exposed
- Update EcoStruxure Power Build Rapsody and avoid opening untrusted project files
- Restrict network access to affected ICS/OT devices and monitor for Node2Shell exploitation attempts
Sources
All live incidents on Threat Watch
