In short: With PHP2Shell, cybersecurity in mid-sized firms rarely fails at patching but at overview. Alongside the website, dealer portals, configurators, careers pages and internal wikis run at different service providers. Only a complete list makes the risk manageable and provable to customers and supervisors.
Typical PHP systems in mid-sized companies
Over the years, manufacturing companies accumulate many web-based applications: B2B shops for spare parts, dealer and partner portals with price lists, product configurators, download areas for technical documentation and CAD data, complaint and service portals, careers pages with applicant management. Internally there are wikis such as MediaWiki, ticket tools and web analytics.
A large part of this runs on PHP. The systems were often commissioned by individual departments, built by agencies and operated at hosts that central IT does not know. That is exactly where the real problem lies with a vulnerability like PHP2Shell.
Which data and connections may be affected
Portals hold customer terms, contacts at dealers, quotation and order data, and drawings that are subject to non-disclosure agreements. Applicant portals contain CVs and references. For competitors and extortionists, design data and price structures are often more valuable than personal data.
The connections are critical: many portals exchange data with the ERP, inventory management or PIM. Anyone who executes code on such a web server finds credentials there for interfaces, databases or VPN. A compromised portal can thus become the entry point into the company network.
Mid-sized business and cybersecurity: supply chain and NIS2
With NIS2, extended obligations on risk management and the reporting of significant security incidents apply to many companies. Whether your company is directly affected depends on sector and size. Many more are indirectly affected, because customers pass security requirements on to their suppliers through contracts.
For the executive board, the question of their own responsibility is added. What generally applies here is explained on the page about management liability. The assessment in the individual case belongs to your legal counsel.
Palo Alto Networks (Unit 42) counted more than 22.6 million exposed, potentially vulnerable instances. A forgotten test system of an agency is just as visible to automated scans as your main website.
The typical responsibility gap in mid-sized firms
| Area | Who often decides | What is missing |
|---|---|---|
| Company website | Marketing with an agency | Patch proof for PHP |
| Dealer portal, B2B shop | Sales with a service provider | Integration into the IT security concept |
| Careers page | HR with a vendor | Clarity about hosting and data |
| Internal tools | Individual departments | Inventory and responsible persons |
Central IT is responsible for network, workstations and ERP, but often has no access to externally hosted systems. This pattern becomes a bottleneck with every critical vulnerability. A simple rule helps: every web application that processes company data is reported to IT, with its operator and contact person, before it goes online.
Cleanly separating web servers and the production network
In industry there are also web applications that talk to machines and plants: service and remote maintenance portals, dashboards with machine data, portals for customers who retrieve the status of the plants delivered to them. Some of these are built on PHP and sit in a network zone that has more connections than the task would require.
A compromised web server must not be a stepping stone into production. Check which connections exist from the web servers' network zones into office and production networks, and restrict them to what is necessary. Credentials stored on web servers should only have the rights the application really needs. This applies especially to remote maintenance access.
First hours for IT management and the executive board
- Create an inventory of all externally reachable PHP systems: domain, operator, PHP version, operating mode, contact person.
- Deal first with systems using mod_php and those on PHP 8.1 or older. With mod_php, the PHP team rates the risk highest.
- For each system, have the patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a backport, and the restart confirmed in writing. Take whatever cannot be confirmed offline temporarily.
- Preserve logs from 20 October 2026 onward and check the web servers' connections into the internal network.
- Document the status concisely, so that you can answer customers, insurers and, where applicable, authorities in a provable way.
How does PHP SOS help?
- Together with IT and the departments, we create the inventory of PHP systems and prioritise by risk.
- We coordinate patches and restarts with agencies and hosts and collect the proof in one place.
- If you suspect a problem, we take over structured incident response with evidence preservation and a review of connections into the company network.
- Afterwards we offer a security audit or penetration test by specialised partners, the result of which you can present to customers.
- On request we monitor the systems continuously, so that the inventory stays current.
Frequently asked questions
Does our company fall under NIS2?
That depends on sector, company size and turnover and has to be checked case by case. Even those who do not fall directly under NIS2 often feel its requirements through customers in the supply chain. You clarify the binding classification with your legal counsel.
Can a hacked web server lead into the company network?
That is possible if the web server has connections into the internal network, such as interfaces to the ERP, shared credentials or a VPN tunnel. Whether this applies to you is shown by a review of network connections and stored credentials.
How do we find all PHP applications in the company?
The starting points are DNS records, certificates, hosting invoices and contracts with agencies. Interviews in marketing, sales, service and HR help as a complement. This usually brings to light systems that the IT department did not even know about.
What do customers expect from us as a supplier after PHP2Shell?
Some customers actively ask whether their suppliers were affected and how they responded. A concise, verifiable account helps: which systems, which patch level, when restarted, which checks for compromise. Promising more than can be proven does harm.