Major industrial technology and operational technology manufacturers have issued customer advisories following the discovery of two critical vulnerabilities affecting the PHP engine. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, allow unauthenticated remote code execution. Because PHP serves as the underlying backbone for numerous enterprise management, engineering, and supervisory control systems, the disclosure has triggered a widespread evaluation cycle across the industrial automation sector.
Evaluating Exposure Across Operational Technology
As security teams rushed to understand the implications of the unauthenticated remote code execution risks, prominent manufacturing and automation enterprises began publishing detailed assessments. Schneider Electric confirmed that three of its key software lines require updates or workarounds, noting that EcoStruxure Security Expert, ProLeiT LINEoptimize, and EcoStruxure Control Engineering are exposed. Similarly, ABB reported that Manufacturing Execution System deliveries utilizing DokuWiki for help documentation require direct intervention by system administrators to update vulnerable PHP packages on hosting servers. In addition, ABB subsidiary B&R outlined remediation plans for its APROL process control system.
Other market participants reported mixed statuses regarding their product portfolios. Siemens revealed that specific Ruggedcom hardware utilizing third-party network operating systems is impacted, while separately confirming that a wide range of computer-aided design, product lifecycle management, and simulation platforms remain unaffected. Other firms, including Johnson Controls, HMS Networks, Wibu-Systems, and Belden, moved swiftly to distribute patches or publish temporary mitigations, such as disabling web management interfaces, to block potential exploitation paths while permanent updates are tested and deployed.
Mitigation Strategies and Ongoing Defense
The discovery of the PHP engine vulnerabilities highlights the complex dependency chains inherent in modern industrial software environments. Many operational technology platforms integrate standard web components to deliver administrative dashboards and user assistance tools. When a core runtime vulnerability emerges, enterprise security teams must inventory vast numbers of embedded systems and enterprise servers.
- Apply official vendor patches or updated firmware versions immediately upon release.
- Disable exposed web interfaces or restrict administrative access to trusted internal networks if direct patches are unavailable.
- Monitor network traffic closely for unauthorized probing or exploitation attempts targeting web application runtimes.
While some automation vendors continue to investigate their component inventories to confirm whether legacy software versions rely on vulnerable codebases, the cybersecurity community emphasizes the importance of rapid asset visibility. Organizations operating industrial control systems are urged to maintain active communication channels with their hardware and software suppliers to ensure remediation guidance is implemented effectively across all production environments.