When the news came out this week about the two 0-day vulnerabilities (CVE-2026-109618, CVE-2026-109619) from PHP, known as PHP2Shell, the first question that many people asked was: Do I use PHP? A lot of control system people assumed that they were unaffected, but just as we saw with Log4J in late 2021 and early 2022, the affected software shows up in a lot of unusual places.
I have published a free post over on CFSN Detailed Analysis (https://patrickcoyle.substack.com/p/php-fallout-in-control-systems) of a list of control system related (broadly related) advisories about system impacts from PHP2Shell. Again, as with Log4J, some of these are nothing more than ‘we are not affected’ reports. This is not an exhaustive list, so check with your vendor if you do not see advisories here for your systems.
Note: I am using the CFSN site rather than this blog because it is easier to read lists of advisories on that site than here. Again, that is a free post.
Posts
No comments:
Post a Comment