MeridianMeridian

Siemens Warns of Critical RUGGEDCOM APE1808 Vulnerabilities Tied to PAN-OS PHP Flaws

Siemens has released an advisory detailing two high-severity vulnerabilities affecting the RUGGEDCOM APE1808 industrial device when running Palo Alto Networks PAN-OS software. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both stem from Use After Free conditions in PHP handling of out-of-memory errors and global state management. Exploitation can lead to remote code execution with CVSS scores of 9.8 and 8.1 respectively. The issues impact all versions of PAN-OS from 10.2 through 12.2 when deployed on the RUGGEDCOM APE1808 platform. Siemens recommends upgrading to patched PAN-OS releases and implementing network segmentation as immediate defensive measures. CISA has republished the advisory to increase visibility across critical infrastructure sectors worldwide.

CISA AlertsTranslated from English

Read at source

Siemens has published a security advisory covering two critical vulnerabilities in the RUGGEDCOM APE1808 industrial appliance when paired with Palo Alto Networks PAN-OS software. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, originate from PHP memory management issues that can be triggered by multiple out-of-memory strategies, ultimately enabling remote code execution.

The first vulnerability, CVE-2026-109618, carries a CVSS v3.1 base score of 9.8 (CRITICAL). It occurs because PHP uses longjmp() for out-of-memory errors without properly initializing request memory in certain contexts. Subsequent cleanup routines may read or branch on uninitialized memory, leading to RCE. The second issue, CVE-2026-109619, scores 8.1 (HIGH) and involves global state that temporarily references request memory; failure to reset this state correctly can leave dangling pointers after memory is freed.

Affected products include RUGGEDCOM APE1808 running PAN-OS versions 10.2 All, 11.1 All, 11.2 All, 12.1 All, and 12.2 All. Both vulnerabilities are listed as known_affected. Siemens advises customers to upgrade to corresponding patched PAN-OS releases and contact support for additional remediation details.

Recommended Mitigations

  • Apply vendor fixes by upgrading to the latest available PAN-OS version.
  • Protect network access to devices using appropriate segmentation and firewalls.
  • Follow Siemens operational guidelines for Industrial Security.
  • Minimize internet exposure of control system devices and place them behind isolating firewalls.
  • Use VPNs for remote access while ensuring they remain updated.

The advisory was originally issued by Siemens ProductCERT and later republished by CISA as ICSA-26-316-05. It affects critical manufacturing sectors worldwide, with the vendor headquartered in Germany.

SiemensPalo Alto NetworksPAN-OSCVE-2026-109618CVE-2026-109619RUGGEDCOM APE1808
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

CISA Issues Advisory on Siemens Desigo CC and Gridscale Products Affected by Critical Brotli Vulnerability
Vulns & Exploits

CISA Issues Advisory on Siemens Desigo CC and Gridscale Products Affected by Critical Brotli Vulnerability

The advisory details how a critical out-of-bounds write vulnerability in the Brotli decoder, tracked as CVE-2026-111497 and nicknamed Node2Shell, impacts multiple Siemens industrial products. Originally disclosed by the Node.js project on October 21, 2026, the flaw resides in Google Brotli versions 1.0.3 through 1.2.0 and can lead to memory corruption, sensitive data disclosure, denial of service, or arbitrary code execution. Affected Siemens offerings include all versions of Desigo CC family V8 and V9, Gridscale X DSA versions from 5.3 up to but not including 5.4, and Gridscale X PSS®E versions below 36.8.0. Siemens has issued remediation guidance recommending installation of the latest .NET security updates or product version upgrades to V5.4 and V36.8.0 respectively. The vulnerability carries a CVSS v3.1 base score of 9.8 and affects critical infrastructure sectors worldwide, including energy and manufacturing. CISA republished the Siemens ProductCERT advisory to increase visibility while emphasizing network segmentation, VPN usage, and pre-deployment validation of patches.

CISA AlertsNov 12, 2026Translated from English

Critical Flaws in Red Hat Quay Expose All Private Container Images to Read and Overwrite Attacks
Vulns & Exploits

Critical Flaws in Red Hat Quay Expose All Private Container Images to Read and Overwrite Attacks

Red Hat has disclosed two critical vulnerabilities in its Quay container registry platform that allow attackers to read, overwrite, or delete private container images across all repositories. The first flaw, CVE-2026-123710 with a CVSS score of 9.8, enables an attacker to inject a persistent trusted signing key that bypasses authentication for any repository, even when anonymous access is disabled. The second issue, CVE-2026-110697 scoring 9.9, stems from an unescaped SQL LIKE pattern in robot account listing that lets any namespace creator steal decrypted tokens from other tenants. Both flaws affect every Quay 3 and Quay 5 release and impact standalone deployments, OpenShift-integrated registries, and the mirror registry. Red Hat recommends blocking the /keys endpoint at the proxy layer, auditing for suspicious service_key_rotate events, and restricting namespace creation containing underscores until patches are applied. The upstream fixes add token rotation validation, mandatory key expiry, and proper escaping for robot account searches.

The Hacker NewsNov 12, 2026Translated from English

SignDrop Zero-Day Exploit Abuses Windows CLFS Mitigation for SYSTEM Privileges
Vulns & Exploits

SignDrop Zero-Day Exploit Abuses Windows CLFS Mitigation for SYSTEM Privileges

Security researcher Abdelhamid Naceri has publicly released a new Windows zero-day exploit named SignDrop that grants attackers SYSTEM-level privileges on vulnerable systems. The flaw stems from mitigations Microsoft introduced in October 2025 to address authentication attacks against the Common Log File System (CLFS) driver. Although the mitigation was intended to reduce CLFS-related exploits, its implementation introduced a logic flaw allowing privileged processes such as Windows Defender to be tricked into creating authentication files with SYSTEM permissions. Naceri demonstrated that the technique works against any antimalware engine's tamper protection because file creation requests appear to originate from the engine's own legitimate process. The exploit has been tested successfully on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, with an estimated 80 percent of Windows installations remaining vulnerable. No official patch is currently available, and disabling the mitigation would re-expose systems to prior memory corruption attacks in CLFS.

BleepingComputerNov 12, 2026Translated from English