Industrial OT Vendors Confirm PHP2Shell Vulnerabilities in Key Products

What happened

On October 21, 2026, the PHP development team released security updates that addressed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell. The flaws reside in the PHP engine’s handling of certain request parameters and enable attackers to execute arbitrary code without authentication. The vulnerabilities were assigned CVSS scores of 10.0 and were publicly disclosed as part of a coordinated vulnerability disclosure program.

The first exploitation attempt was observed on October 17, 2026, just days before the official patch was made available. Cloudflare’s threat intelligence platform logged millions of automated scans and exploitation attempts targeting the vulnerable PHP versions. While the industry initially reported no confirmed successful attacks, the sheer volume of attempts indicates that threat actors are actively probing for exposed systems.

Who is affected

Several leading industrial automation and control vendors have confirmed that portions of their product lines are impacted by PHP2Shell. Siemens has identified affected firmware in its SIMATIC PCS 7 and TIA Portal families. Schneider Electric’s EcoStruxure Industrial Gateway and Modicon M221 series are also listed as vulnerable. ABB’s AC500 and AC500-AX series, Rockwell Automation’s Allen‑Bradley ControlLogix controllers, and Johnson Controls’ Metasys HVAC controllers have all issued advisories.

Not all products from these vendors are affected. Many legacy systems and earlier firmware releases are not vulnerable, and some vendors are still conducting a full assessment of their supply chain. In the meantime, customers are advised to verify the specific firmware or software version installed on each device before proceeding with remediation.

Impact

PHP2Shell enables unauthenticated remote code execution, which can lead to complete takeover of the affected system. In the context of industrial control systems, this means an attacker could alter process parameters, inject malicious scripts into PLCs, or compromise the integrity of SCADA dashboards. The potential for physical harm or production downtime is significant, especially in safety‑critical environments such as power generation, water treatment, and manufacturing lines.

Beyond immediate control of the device, the vulnerability can serve as a foothold for lateral movement. An attacker who gains code execution on a gateway or edge device can pivot into the broader OT network, exfiltrate sensitive configuration data, or deploy additional malware such as ransomware or sabotage tools.

Exposure

Threat intelligence reports indicate that the vulnerability is being actively scanned by automated bots worldwide. The volume of attempts has surged since the public disclosure, with Cloudflare reporting over 5 million distinct IP addresses targeting the vulnerable PHP versions. While no widespread exploitation has been confirmed, the high level of scanning activity suggests that attackers are preparing for a coordinated campaign.

In addition to automated scans, there have been a handful of reported incidents where attackers successfully leveraged PHP2Shell to compromise a remote web interface on an industrial gateway. These incidents involved the injection of shell commands that allowed the attacker to download and execute additional payloads, demonstrating the real‑world feasibility of the exploit.

What to do

• Verify the PHP version running on all web‑based interfaces of OT devices. Apply the latest PHP security patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) as soon as possible.
• Update firmware on all affected industrial controllers and gateways to the latest vendor releases that address PHP2Shell.
• Implement network segmentation between IT and OT networks; isolate exposed web interfaces behind a dedicated DMZ.
• Deploy a Web Application Firewall (WAF) configured to block anomalous PHP requests and rate‑limit traffic to vulnerable endpoints.
• Enable logging and monitoring of all web traffic to OT devices; set up alerts for suspicious request patterns such as repeated POSTs to /index.php or /api.
• Conduct a rapid vulnerability scan of the OT network to identify any remaining exposed PHP services.

What to watch

Keep an eye on new advisories from the affected vendors. Several are still assessing the full scope of their product families, and additional firmware updates may be released in the coming weeks. The threat landscape is evolving, and attackers may develop new exploitation techniques that leverage PHP2Shell as a pivot point.

Monitor threat intelligence feeds for indicators of compromise related to the vulnerability, such as newly discovered exploit code or malicious domain registrations. Pay particular attention to any activity targeting the specific product families mentioned above, as these are the most likely to be exploited in targeted campaigns.