When Siemens, Schneider Electric, and ABB all publish advisory activity around the same vulnerability family in the same news cycle, that is not a coincidence — it is a supply-chain signal. The vendors have confirmed that some of their industrial products are affected by the PHP2Shell vulnerabilities, a set of flaws in PHP that can be leveraged to achieve remote code execution on systems running vulnerable, exposed PHP components. Other industrial vendors are actively auditing their portfolios, which means the affected-product list is going to grow.
This matters because PHP is deeply embedded in OT and ICS products — often invisibly. Embedded web servers, engineering workstation components, HMI configuration portals, gateway devices, and remote-access appliances frequently ship with bundled PHP runtimes that asset owners never installed and may not know exist. A vulnerability class that turns an exposed PHP endpoint into a shell is exactly the kind of foothold an adversary needs to pivot from IT into operations, or to establish persistence on a device that will never see an EDR agent.
If you run any of the named vendors' gear — or any industrial product with an embedded web interface — treat this as an active patch-and-hunt cycle, not a routine advisory.
Technical Analysis
What PHP2Shell Is
PHP2Shell refers to a family of PHP vulnerabilities whose practical impact is straightforward: an attacker who can reach a vulnerable PHP component over HTTP can escalate to command execution on the underlying host. The name captures the attacker's goal — PHP in, shell out. From a defender's perspective, the exploitation chain typically looks like this:
- Reconnaissance: The attacker scans for exposed HTTP/HTTPS services — embedded web consoles on ICS devices, gateways, or management interfaces. Industrial products are frequently fingerprintable by banner, TLS certificate, or login page.
- Trigger: A crafted HTTP request is sent to the vulnerable PHP component. Depending on the specific flaw, this may involve malformed request parameters, argument injection through PHP-CGI style invocation, or abuse of insecure request handling in the bundled PHP runtime.
- Execution: The PHP interpreter executes attacker-controlled commands in the context of the web service account. On embedded industrial devices this is frequently a privileged context —
rooton Linux-based appliances orSYSTEM/LocalServiceon Windows-based engineering software. - Post-exploitation: Web shell deployment, credential harvesting from the device, and lateral movement toward engineering workstations, historians, or — in the worst case — controllers.
Affected Products and Vendors
Confirmed at the time of writing:
- Siemens — has confirmed some products are affected; refer to Siemens ProductCERT advisories for the per-product disposition list.
- Schneider Electric — has confirmed affected products; see Schneider Electric security notifications (SEVD/SESA series).
- ABB — has confirmed affected products; see ABB cybersecurity advisories.
- Other vendors — actively auditing portfolios; expect additional confirmations.
Because the affected-product matrices are still being populated by each vendor, the only authoritative source is each vendor's advisory feed. Do not assume a product is unaffected just because it hasn't been named yet — assume it is unassessed.
Exploitation Status
The confirmation by multiple major ICS vendors indicates these flaws are being treated as high-impact and practically exploitable against exposed components. PHP vulnerabilities with remote-code-execution impact historically move from disclosure to opportunistic scanning within days, and internet-exposed OT management interfaces are routinely indexed by Shodan, Censys, and adversary reconnaissance infrastructure. Defenders should operate under the assumption that any reachable vulnerable instance is a live target, and monitor CISA's Known Exploited Vulnerabilities catalog and CISA ICS advisories for updates to exploitation status.
Detection & Response
The highest-fidelity detections for this class of attack are behavioral: a PHP interpreter or embedded web server process spawning a shell or command interpreter is almost never legitimate on an industrial device. The detections below are tuned for that behavior and for web-shell staging artifacts.
---
title: PHP Process Spawning Shell or Command Interpreter
tatus_placeholder: remove
id: 3f8a1c92-7d4e-4b5a-9c31-2e6f8a0b1d44
status: experimental
description: Detects a PHP interpreter (php.exe, php-cgi.exe, php, php-cgi) spawning a command shell or scripting interpreter, consistent with PHP2Shell-style remote code execution against embedded or application PHP components.
references:
- https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\php.exe'
- '\php-cgi.exe'
- '\httpd.exe'
- '\nginx.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\whoami.exe'
- '\net.exe'
- '\nltest.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate PHP applications invoking system commands (rare in OT/embedded contexts)
- Web application installers and maintenance scripts
level: high
---
title: Web Shell File Creation in Web-Served Directories
id: 91b2e4a7-5c6d-4f18-8a72-0b3c9d5e7f66
status: experimental
description: Detects creation of PHP script files in web-served directories by non-administrative processes, a common artifact of PHP2Shell post-exploitation web shell staging on industrial gateways and management interfaces.
references:
- https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection_ext:
TargetFilename|endswith:
- '.php'
- '.phtml'
- '.php5'
- '.phar'
selection_path:
TargetFilename|contains:
- '\wwwroot\'
- '\htdocs\'
- '\www\'
- '\web\'
- '\html\'
- '\inetpub\'
filter_deploy:
Image|endswith:
- '\msiexec.exe'
- '\setup.exe'
- '\devenv.exe'
condition: selection_ext and selection_path and not filter_deploy
falsepositives:
- Legitimate web application deployment or update processes
level: medium
// Hunt for PHP/web server processes spawning command interpreters across Windows endpoints
// and Linux OT-adjacent systems ingested via Syslog/CEF into Sentinel.
// Windows: Defender process telemetry
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("php.exe", "php-cgi.exe", "httpd.exe", "nginx.exe")
| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe",
"ipconfig.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe",
"rundll32.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;
// Linux/embedded: Syslog-ingested process execution (auditd/CEF) for php-fpm/php-cgi spawning shells
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("php", "php-fpm", "php-cgi", "httpd", "nginx", "lighttpd")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "/bin/dash", "nc -", "ncat", "/dev/tcp")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;
// Network-side: inbound HTTP requests with suspicious PHP-CGI/argument-injection style patterns
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("php-cgi", "?%AD", "-d+allow_url_include", "auto_prepend_file", "php://input")
or RequestMethod == "POST" and RequestURL endswith ".php" and AdditionalExtensions contains "php://input"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, DeviceVendor, DeviceProduct
| order by TimeGenerated desc
-- Hunt for PHP or embedded web server processes that have spawned child command interpreters.
-- Deploy across Windows engineering workstations, HMIs, and OT DMZ servers via Velociraptor.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
SELECT Pid
FROM pslist()
WHERE Name =~ '(?i)php(-cgi)?\.exe|httpd\.exe|nginx\.exe'
)
AND Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe|whoami\.exe|net\.exe|certutil\.exe|rundll32\.exe|mshta\.exe'
#!/usr/bin/env bash
# PHP2Shell exposure triage for Linux-based OT DMZ hosts, gateways, and management appliances.
# Run from an administrative jump host; do NOT install scanners directly on production OT assets.
set -euo pipefail
echo "=== [1] Locate PHP interpreters and report versions ==="
for bin in php php-cgi php-fpm; do
if command -v "$bin" >/dev/null 2>&1; then
echo "[+] Found: $(command -v $bin)"
"$bin" --version 2>/dev/null | head -n 2
fi
done
find /opt /usr/local /var/www /srv -name 'php*' -type f -executable 2>/dev/null | head -n 25
echo "=== [2] Enumerate listening web services that may front PHP ==="
ss -tlnp 2>/dev/null | grep -Ei ':(80|443|8080|8443|8000|8888)\b' || echo "[-] No common web ports listening"
echo "=== [3] Check for PHP-CGI exposure (high-risk invocation pattern) ==="
grep -RIl --include='*.conf' -E 'php-cgi|Action php-cgi|ScriptAlias /php' \
/etc/apache2 /etc/httpd /etc/nginx /etc/lighttpd 2>/dev/null || echo "[-] No php-cgi config references found"
echo "=== [4] Hunt for recently dropped .php files (potential web shells) ==="
find /var/www /srv/www /opt -name '*.php' -mtime -14 -type f 2>/dev/null | while read -r f; do
echo "[?] Recent PHP file: $f"
grep -lE 'eval\(|base64_decode\(|shell_exec\(|passthru\(|system\(|php://input|assert\(' "$f" 2>/dev/null \
&& echo " [!] Suspicious function pattern in $f"
done
echo "=== [5] Hardening: deny outbound connections from web service accounts ==="
echo " - Apply egress firewall rules blocking outbound traffic from www-data/nginx/lighttpd UIDs"
echo " - Example (nftables): nft add rule inet filter output skuid www-data reject"
echo "=== [6] Verify vendor patch status ==="
echo " - Cross-reference installed vendor product + firmware against:"
echo " Siemens ProductCERT: https://cert-portal.siemens.com/productcert/html/advisories.html"
echo " Schneider Electric: https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
echo " ABB: https://global.abb/group/en/about/our-businesses/cyber-security/alerts-and-notifications"
echo " CISA ICS Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory_type%3A93"
Remediation
- Pull each vendor's advisory and build your affected-asset matrix today. Do not wait for your patch cycle. Use the official feeds:
- Siemens ProductCERT advisories: https://cert-portal.siemens.com/productcert/html/advisories.html
- Schneider Electric security notifications: https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
- ABB cybersecurity alerts and notifications: https://global.abb/group/en/about/our-businesses/cyber-security/alerts-and-notifications
- CISA ICS advisories (aggregated): https://www.cisa.gov/news-events/cybersecurity-advisories
- Inventory your shadow PHP. Most OT asset owners cannot answer "where is PHP running in my environment?" Scan for PHP interpreters on engineering workstations, HMI servers, OT DMZ hosts, and gateway appliances. SBOMs from vendors, where available, shortcut this work — request them.
- Apply vendor patches and firmware updates per the advisories. Follow each vendor's specified fixed version for your exact product line and firmware branch — ICS fixes are frequently branch-specific. Where maintenance windows are required, schedule them now rather than deferring a quarter.
- Where no patch is available yet, apply compensating controls immediately:
- Remove network reachability: ensure embedded web interfaces are not internet-exposed and are reachable only from hardened jump hosts in the OT DMZ. Validate with an external scan — do not trust firewall documentation.
- Disable the web management interface if operationally feasible, or restrict it to an allow-listed management VLAN.
- Deploy virtual patching via the OT DMZ firewall or IPS: block requests containing PHP-CGI invocation patterns,
php://input, and argument-injection strings toward affected devices. - Enforce strict egress filtering from OT segments. RCE without outbound connectivity dramatically limits post-exploitation value.
- Hunt before you patch. Run the KQL and VQL hunts above against telemetry going back at least 7–14 days. Patching first destroys forensic evidence of pre-patch exploitation.
- Monitor CISA KEV. If any component of this vulnerability family lands on the Known Exploited Vulnerabilities catalog, federal deadlines will attach — but treat KEV inclusion as a floor, not a trigger. Industrial RCE with multi-vendor impact warrants action regardless.
- Reset credentials on any device confirmed exposed and reachable. Assume credential material on a compromised embedded device is gone, including service accounts used by historians and engineering software.
The strategic lesson is one we've been relearning for a decade: the vulnerabilities that hurt OT environments are rarely in the PLC ladder logic — they're in the commercial off-the-shelf software bundled around it. PHP, OpenSSL, Log4j — the component you didn't buy is the one that gets you breached. If you don't have a software-component inventory for your industrial estate, this advisory cycle is your business case for building one.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.