PHP2Shell will linger in OT sites well beyond 2030

Critical PHP2Shell vulnerabilities allowing unauthenticated RCE affect web interfaces of industrial controllers, routers, EV chargers and energy equipment. Attacks began four days before the October 21 disclosure, and no official patches exist for PHP 8.1 and older.

• PHP2Shell attacks were seen from October 17, before the October 21 disclosure
• Affected gear includes WAGO, Kunbus, NetModule, PAN-OS and eCharge chargers
• PHP 8.2 reaches end of life in late 2026, 8.3 in late 2027
• Vulnerable OT web interfaces will likely persist beyond 2030