OVEL Inc. (Shibuya, Tokyo; Representative Director Kosei Oka) examined, using public information from manufacturers and public agencies, how the two critical PHP vulnerabilities disclosed on October 21, 2026 (known as PHP2Shell) reach control systems (OT) in factories and plants.
Key findings
- The confirmed impact is on a firewall OS that also runs on factory models. Palo Alto Networks announced that all PAN-OS versions from 10.2 to 12.2 and Panorama are affected, with no date yet for a fix. Its ruggedized firewalls for harsh sites such as factories (PA-220R, PA-450R and others) support PAN-OS versions that include affected ones. How widely they are deployed in control system environments is not known.
- PHP is in control devices too. Documents from manufacturers and public agencies show PHP in PLC web interfaces, touch-panel HMIs, protection relays, RTUs, IO-Link masters, industrial switches, and solar, EV charging, and fuel management equipment.
- Some published firmware bundles an affected PHP version. In the firmware source that WAGO publishes for its PLCs and touch panels, php-cgi is enabled in the latest source and the bundled PHP is 8.4.10. The PHP team lists 8.4 releases before 8.4.27 as affected. Whether an attack works on the devices has not been confirmed.
- CISA advisories show PHP-based control products every year. Of 3,970 CISA ICS advisories, 22 show the product uses PHP. Through October 21, 2026 there were 7, the most of any year since 2021. This counts advisories; it is not the share of control devices that use PHP.
- The impact on control devices is not yet known. As of October 22, no manufacturer had announced that a control device itself is affected. No notice does not mean no impact.
Three recommendations for manufacturers
- Be able to say where PHP runs in your plant
- Narrow the paths to management interfaces until fixes arrive
- Assume intrusion and contain damage within zones
