Manufacturers’ exposure may lie in overlooked web interfaces and embedded components. CISA warns that PHP’s prevalence “may not be directly observable.”
Website admins around the world spent Wednesday racing against the clock as PHP, the scripting language quietly running roughly 70% of websites, was ground zero for what researchers are calling arguably one of the most severe software vulnerabilities ever. The source of the vulnerabilities was two flaws that were more than a decade old but were exposed almost overnight with the help of artificial intelligence.
For manufacturers, the exposure isn’t where most people would look first. PHP2Shell is currently considered unlikely to threaten industrial environments such as IT/OT, ERP, PLM and MES because those systems generally aren’t built on PHP. Exposure may instead sit in overlooked or poorly inventoried components around those systems, including device consoles, supplier portals, legacy dashboards and third-party add-ons.
The trouble began on October 20, when details of two critical bugs—tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity—leaked onto Hacker News and X, forcing PHP’s maintainers to scramble an emergency security patch before its planned release, according to a report by Ars Technica. The vulnerabilities, which researchers quickly nicknamed PHP2Shell, had lurked undisturbed in PHP’s core code since version 5.4 was released in 2012. Cloud and AI cybersecurity firm Wiz said turning the longstanding flaws into working exploits required complex chains of memory-corruption bugs, a process that AI substantially accelerated.
Working independently, researchers from Wiz and cybersecurity firm Calif used frontier AI models—including Gemini 4 Argon and GPT‑5.6 Sol—to do in days what might once have taken a specialist team months. The work chained together obscure memory-corruption bugs into a working, unauthenticated remote-code-execution exploit against WordPress, Drupal, and Joomla installations straight out of the box.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” the Wiz team wrote in a blog post, comparing the moment to the 2014 Heartbleed bug that shook the web’s encryption backbone.
Wiz has since released an updated guidance document outlining the latest required actions here.
By the time PHP’s security team pushed out patched versions—8.2.35, 8.3.36, 8.4.27 and 8.5.12—on October 21, the damage control had already begun. Government agencies across Europe pulled public-facing websites offline as a precaution, including Dutch and Finnish government portals and France’s Interior Ministry. Amazon and Cloudflare later reported signs that attackers may have been testing exploitation attempts even before the public disclosure.
Hidden in plain sight
That blind spot is already showing up in the numbers. Within hours of PHP’s October 21 disclosure, Cloudflare said it had logged millions of exploit attempts against the flaws.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching to the fixed releases—8.5.12, 8.4.27, 8.3.36, and 8.2.35—while cautioning that PHP’s footprint “may not be directly observable,” a pointed warning for operators who don’t know everything on their network that’s quietly running it. CISA said it had not observed active exploitation as of publication. Canada’s Centre for Cyber Security issued a parallel advisory, AL26-026, covering both CVEs for domestic organizations. The Treasury Board of Canada confirmed the federal government was actively patching its own systems, with some government websites experiencing temporary disruption but no indication of compromise.
Industrial vendors moved quickly to get ahead of the question of whether their own products were exposed. Siemens acknowledged the two vulnerabilities in an advisory posted to its CERT portal—the site where Siemens publishes cybersecurity information, security advisories, and vulnerability mitigation—saying more details were forthcoming. In a direct statement to Engineering.com, a Siemens spokesperson said: “Siemens is aware of zero-day flaws exploit on PHP and is actively working on the remediation of infrastructure, OT environment and affected products.”
Cisco, meanwhile, said it had found no products currently known to be affected, though it listed its Unified Industrial Wireless Software and IoT Control Center as “Under Investigation” in an advisory first issued October 21 and updated the following day.
Palo Alto Networks confirmed direct exposure, warning that all versions of its PAN-OS and Panorama appliance platforms are affected. The exposure is confined strictly to the management web interface rather than core traffic routing, and while Palo Alto evaluated the threat primarily as a potential service outage with no confirmed exploitation to date, official software fixes remain pending.
The exposure also extends to cloud-hosted applications. Google said its cloud platform itself is not vulnerable, but customers running PHP applications on Google Cloud may be affected. While some supported runtimes receive automatic security updates, customers using their own container images must rebuild them with a patched version of PHP and redeploy—a reminder that cloud hosting does not necessarily transfer responsibility for fixing the underlying runtime.
The fullest picture of the industrial fallout is still being assembled. A tracker maintained by the Dutch National Cyber Security Centre, NCSC-NL, had as of October 22 logged 635 products from roughly 430 suppliers—notably, no named ERP, PLM, or MES platform appeared on the list. Two products flagged for investigation via third-party reporting stood out instead: Entelliweb, a building management system, and EfficientIP, a network automation platform. While neither has been confirmed as affected, these are the type of peripheral, easy-to-overlook web interfaces that may catch IT departments off guard.
Because these flaws could be present in under-the-radar applications, IT teams at manufacturing firms should build an inventory of every runtime, appliance and embedded component on their network that runs PHP.
“AI is changing the economics of cybersecurity. The speed at which vulnerabilities can be discovered and exploited is accelerating, while many organizations still rely on maintenance, patching and governance processes designed for a much slower world,” says Lionel Grealou, a digital transformation expert and author.
“The cybersecurity exposure of enterprise platforms goes well beyond their core technology. Integrations, extensions and bespoke applications create additional attack surfaces that organizations do not always manage with the same discipline as their core systems. Ultimately, cybersecurity is as much about lifecycle management and architectural accountability as it is about technology,” he says.
