The Real OT Risk Isn't the Latest Headline
Recent PHP vulnerabilities triggered an interesting conversation with some of our Operational Technology (OT) customers. But the bigger concern wasn't PHP.
In October 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as php2shell) were disclosed, raising concerns about potentially exposed systems. Both allow unauthenticated remote code execution, and within days they were being actively exploited.
A few of our customers reached out asking whether their OT deployments were affected.
PHP Wasn't the Problem
For one customer, our review confirmed that PHP was not applicable to their OT systems. However, we identified several other known vulnerabilities that were still sitting in the patching backlog, awaiting assessment or remediation.
And this is where the real challenge lies.
Why OT Vulnerabilities Linger
In OT environments, vulnerabilities can remain unaddressed for months due to operational constraints, vendor dependencies and limited maintenance windows.
In June 2026, a cybersecurity incident at Australia's second-largest raw sugar producer brought operations at two of its sugar mills to a halt, disrupting production and cane harvesting.
While the circumstances of that incident are different, it reminds us how significantly cybersecurity incidents can impact industrial operations.
From Reactive to Proactive
Patching OT systems is not always straightforward. But leaving known vulnerabilities unassessed or unmanaged isn't a sustainable strategy either.
So the question is whether we are managing OT cybersecurity proactively, or simply reacting whenever a new vulnerability makes headlines.
An effective OT cybersecurity program needs four things working together:
- A regular cadence of vulnerability assessments, so known issues are reviewed on a schedule rather than when a headline forces it.
- Risk-based patching, prioritised by exploitability and operational impact.
- Compensating controls, such as segmentation and access restrictions, where a patch can't be applied straight away.
- Remediation tracking, so every known vulnerability is owned, scheduled and closed out.
The next major vulnerability announcement shouldn't be what prompts us to revisit the vulnerabilities we already know about.
Parasyn works with critical infrastructure operators to assess, prioritise and track OT vulnerabilities as an ongoing program, not a one-off scan. Talk to our team about where your backlog stands.