PHP2Shell Exposes Hidden Risks in Factory Systems

In factories around the world, aging equipment may be running web software that nobody has checked in years. It might be the admin screen for a management server or a piece of plant equipment installed a decade ago. And it might be running PHP.

That's the kind of system PHP2Shell puts at risk. On October 21, emergency patches were released for two critical PHP2Shell vulnerabilities after details of the flaws leaked before fixes were ready. The news set off a global scramble. Governments and businesses across Europe, Asia, and North America took websites and services offline. Attackers had already begun probing for weaknesses before the patches arrived. Within days, CISA confirmed that attackers were exploiting the flaws.

Now industrial vendors are checking their own products. Siemens, Schneider Electric, ABB, and Johnson Controls are among the major vendors that have issued PHP2Shell security advisories.

For manufacturers, the bigger risk sits behind the website. Aging web interfaces and management systems often connect to the equipment that runs production. If attackers break in through one of them, trusted connections can carry them toward the systems that keep a plant running. And many of those systems can't be patched quickly, or at all.

Trevor Dearing, director of critical infrastructure solutions at Illumio, says PHP2Shell exposes a problem that's been building for years: aging equipment, hidden software risks, and trusted connections that let attackers move far beyond their first point of entry. The answer, he argues, is to find those systems, limit what can reach them, and plan to contain an attack before it spreads.

The biggest risks may be hiding in plain sight

Walk through a modern factory, and you'll find systems working behind the scenes to keep production running. Many rely on web interfaces to monitor, manage, and maintain operations.

"There's a lot of equipment in a manufacturing environment that has a web interface," Dearing said. "A lot of this isn't necessarily the newest equipment. It's been installed over the last 10, 15, 20 years."

Those interfaces may contain PHP software that manufacturers don't even know exists. Some of it hasn't been updated in years. Other systems may no longer have vendor support. Even when patches are available, installing them may mean shutting down equipment that plants need to keep running.

But before manufacturers can patch these systems, they must find them.

"I think it's the hidden risks that are the biggest issues," he said.

Finding those risks isn't easy. Unlike most IT networks, industrial networks can't always handle active vulnerability scanning. Scans can disrupt sensitive equipment or halt production. Passive monitoring poses less risk, but it relies on accurate device records and up-to-date vulnerability databases.

What if the vendor has gone out of business or the device isn't listed in those databases? Then vulnerable software could stay hidden for years.

That's why PHP2Shell's industrial exposure could last long after the initial patching emergency.

Attackers don't need to hack a PLC to stop production

A factory's programmable logic controllers (PLCs) manage physical processes, but they don't work alone. Engineering workstations, data historians, and other connected systems help operators monitor and control production.

A vulnerable web interface could give attackers a foothold. From there, they may try to reach systems with the authority to change or shut down equipment.

"If you can get into the system through any interface that is PHP, and you can get control of an engineering workstation, you can just effectively turn off the PLCs, or you can power things down, or you can reconfigure them," Dearing said.

"So, the PLC isn't always really a great target. It's the things that control the PLCs that are really the targets for attackers," he said.

For ransomware groups, a production shutdown is leverage for extortion. State-sponsored groups may go after industries with strategic value, such as food production and other critical infrastructure.

Both kinds of attackers are already circling PHP2Shell. Security firm CYFIRMA has tied exploitation activity to a suspected North Korean operator linked to the Lazarus Group, though it based that call on behavioral and linguistic clues. Researchers at Dream reported a China-linked actor using PHP2Shell to take over firewalls.

PHP2Shell alone doesn't give attackers access to operational technology (OT). But weak boundaries and trusted connections could turn a compromised web application into a threat to production.

Trusted connections can become attack paths

Manufacturers rely on equipment vendors, suppliers, and maintenance partners to keep production running. These partners often need remote access to diagnose faults, update systems, and maintain equipment.

But those connections can also expand the attack surface.

Many industrial systems use web interfaces or remote desktop connections for management. If attackers compromise one of these systems, they may use trusted connections to move deeper into the network.

Dearing recommends using jump hosts to protect sensitive equipment or Zero Trust Network Access (ZTNA) to control remote connections. The goal is to give trusted suppliers the access they need without opening attack paths to systems they don't.

When you can't patch, control the connections

Manufacturers can't always replace old equipment or patch it right away. But they can limit who and what can reach those systems.

Dearing describes this approach as virtual patching. Rather than fixing the flaw itself, manufacturers reduce a vulnerable device's exposure by controlling its connections.

A device may have dozens of vulnerabilities. But if it communicates with only one other system, and that connection is tightly controlled, its exposure may be far lower.

First, manufacturers need to map how their systems connect. Which links are vital to production? Which systems need to talk to each other? And which paths can they close?

Segmentation can then block unneeded access to vulnerable systems. It acts as a compensating control when a patch isn't ready or a plant can't shut down to install it.

The ultimate goal: Keep manufacturing running

PHP2Shell won't be the last vulnerability to threaten aging industrial equipment. And manufacturers may never reach a point where every system can be patched immediately.

That's why Dearing argues that containment must become part of operational planning.

He describes an isolation policy as a "big red button" that protects the systems needed for minimum viable operations.

"If you detect that there is an attack happening somewhere, you can press the big red button and you can isolate your most important things that contribute to your primary service, so that you can continue to operate during the attack and effectively after it as well," he said.

That button takes planning. Manufacturers need to know which systems support production, understand how those systems depend on each other, and set isolation policies before an attack.

The next PHP2Shell may already be sitting in a web page nobody remembers installing. Manufacturers can't control when it surfaces. They can control which systems talk to each other, how far an attacker can move, and whether one forgotten interface becomes a plant-wide crisis.