The fuel management systems that dispense and track diesel for fleets, depots and emergency vehicles are, in at least one product family, still running PHP 7.1.5. CISA said on August 27, 2026 that this leaves four lines of All-Line Equipment Company's Fuel-Boss carrying two remote code execution flaws, one from 2018 and one from 2019. Two of the four have a fix. One does not have one yet. One is never getting one.
The advisory, ICSA-26-239-02, was published after the flaws were reported anonymously to CISA. Neither bug is new; both are long-patched issues in the PHP interpreter underneath the product, which is exactly what makes the disclosure worth reading.
Where these boxes actually sit
CISA lists Fuel-Boss deployments worldwide across critical manufacturing, the defense industrial base, emergency services and transportation systems. That is the part that raises this above a routine version-bump notice. A fuel dispensing controller is not a piece of office IT, and an attacker who can run commands on one is inside a network that was probably never designed to have an internet-facing web application on it.
Buffer writes and an argument that becomes a command
The more severe of the two is CVE-2019-11043, scored 8.7 under CVSS v3.1 and 9.4, critical, under CVSS v4. In certain PHP-FPM configurations, the module writes past its allocated buffers into space reserved for FastCGI protocol data, which creates a possible remote code execution condition.
The second, CVE-2018-19518, is scored 7.5 under v3.1 and 7.7 under v4. It sits in the University of Washington IMAP Toolkit used by PHP's imap_open() function, which launches an rsh command without preventing argument injection. Where rsh has been replaced by a program with different argument handling, such as ssh, an IMAP server name containing a "-oProxyCommand" argument turns into arbitrary operating system commands. The same code path also carries a stack-based buffer overflow.
One caveat belongs up front rather than buried: CISA states that both vulnerabilities have high attack complexity. That is not a reason to leave them, but it does mean this is not a point-and-click compromise.
Two patched, one pending, one abandoned
Fixes exist for Fuel-Boss V1 Standard and V1 Portal, and the only route to them is a phone call to All-Line Equipment Company on 866-356-3336. There is no download link and no self-service update. The V1 Master/Slave line has no fix available yet. For V1 Backflush Systems, the vendor says no fix is planned at all, which makes network isolation the permanent answer rather than a stopgap.
The vendor's own recommendation for anything unfixed is to take it off the internet, or to restrict which IP addresses can reach it at the router. CISA adds its standard control-system guidance: keep these devices off the public internet, put them behind a firewall and away from the business network, and use a VPN for remote access while remembering the VPN is only as secure as the device on the other end.
Fuel-Boss is one of five ICS advisories CISA issued on the same day, and comes days after the set covering truck brakes and ship transponders. The pattern in these advisories is rarely an exotic new bug. It is an operational product carrying a years-old dependency, sold into sectors that cannot easily take the equipment offline, and attackers are getting faster at finding those.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.