Industrial vendors confirm PHP2Shell affects some of their products, from cameras and gateways to engineering software
October 26, 2026 (October 21 to 30, 2026)
After PHP's October 21 emergency fixes (see the PHP2Shell entry), industrial suppliers have been checking whether their products embed a vulnerable PHP. SecurityWeek reports that Siemens, Schneider Electric, ABB and others confirmed some products are affected. Schneider Electric named three: EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering. Johnson Controls released patches for several Illustra camera lines and fixed Visonic PowerManage in version 5.0.45. HMS says it patched or removed vulnerable PHP in its Talk2M remote-access services and Argos documentation server and found no signs of compromise. CONTEC has released fixes for its CONPROSYS Linux SDK, M2M controllers, gateways and PACs. Rockwell Automation had confirmed no affected products as of its notice, Hitachi Energy was still investigating, and Moxa said none of its products are affected. Engineering.com notes that core industrial software such as ERP, PLM and MES is generally not built on PHP, so the exposure is mainly in web-facing components.
Why it matters
Embedded PHP in industrial products rarely updates itself, and these web interfaces are often reachable from business networks. Because the flaws are already exploited on ordinary web servers, any industrial web interface that can be reached from the internet should be treated as at risk.
What defenders can take from it
- Check your vendors' advisories for products with web interfaces, and apply fixes as they arrive. The Dutch NCSC keeps a public list of affected products.
- Keep the web interfaces of gateways, cameras, building controls and engineering tools off the internet.
- Where no fix exists yet, restrict access to trusted networks or take the interface offline, as CISA advises for systems that cannot be patched.