TL;DR: PHP2Shell has been the target of widespread attack attempts since its disclosure on October 21, 2026, with first attempts seen as early as October 17 according to Amazon. A login does not protect you, and there are no official updates for PHP 8.1 and older. In industrial sites, PHP sits in the web interfaces of controllers, industrial routers and firewalls, as well as EV chargers and energy equipment whose firmware is rarely updated. Operators should cut these web interfaces off from the internet now. Vulnerable PHP web interfaces will in all likelihood still be found in industrial sites well beyond 2030.

This is an English adaptation of my German original .

On October 21, 2026, the PHP team closed two critical vulnerabilities known as PHP2Shell. Both allow remote code execution without authentication. The BSI (German Federal Office for Information Security) warns at level 3 (orange). The discussion so far mostly centers on websites and online shops.…