ABB updated its advisory for the ASPECT building management system family on 29 October 2026 (Revision B). The advisory covers two PHP vulnerabilities, known as PHP2Shell, that can lead to remote code execution through specially crafted messages to the system. ABB says new firmware above 3.09.00 is coming for AlmaLinux-based units. It has no plans to fix NEXUS units on CentOS 6 or MATRIX units, which must rely on mitigations. Affected products and IDs ASPECT-Enterprise, NEXUS Series and MATRIX Series, firmware 3.09.00 and earlier. CVE-2026-109618 (CVSS 3.1 9.8) and CVE-2026-109619 (CVSS 3.1 8.1). ABB advisory 9AKK108473A4963. Exploitation status Both CVEs were added to the CISA Known Exploited Vulnerabilities catalogue on 26 October 2026 (exploited in the wild). Why it matters to OT operators BMS controllers often sit next to OT networks and get reached through remote access. ABB says to disconnect any ASPECT unit that is directly exposed to the internet or reached through NAT port forwarding, use only secure, up-to-date VPNs for remote access, and upgrade to the latest firmware. Sources ABB ASPECT PHP advisory, 29 Oct 2026 ABB alerts page CISA KEV catalogue Source dates: 29 Oct 2026.
ABB updated its advisory for the ASPECT building management system family on 29 October 2026 (Revision B). The advisory covers two PHP vulnerabilities, known as PHP2Shell, that can lead to remote code execution through specially crafted messages to the system. ABB says new firmware above 3.09.00 is coming for AlmaLinux-based units. It has no plans to fix NEXUS units on CentOS 6 or MATRIX units, which must rely on mitigations. Affected products and IDs ASPECT-Enterprise, NEXUS Series and MATRIX Series, firmware 3.09.00 and earlier. CVE-2026-109618 (CVSS 3.1 9.8) and CVE-2026-109619 (CVSS 3.1 8.1). ABB advisory 9AKK108473A4963. Exploitation status Both CVEs were added to the CISA Known Exploited Vulnerabilities catalogue on 26 October 2026 (exploited in the wild). Why it matters to OT operators BMS controllers often sit next to OT networks and get reached through remote access. ABB says to disconnect any ASPECT unit that is directly exposed to the internet or reached through NAT port forwarding, use only secure, up-to-date VPNs for remote access, and upgrade to the latest firmware. Sources ABB ASPECT PHP advisory, 29 Oct 2026 ABB alerts page CISA KEV catalogue Source dates: 29 Oct 2026.