Critical vulnerabilities in PHP are raising questions about how organizations can identify and secure legacy systems that may have been deployed more than two decades ago.
The flaws have reportedly existed since 2004, leaving current security teams to manage systems originally installed and maintained by personnel who may no longer be with their organizations.
Madelein van der Hout, a senior analyst at Forrester Research, had some interesting comments for TechNewsWorld and explained that what makes these vulnerabilities significant is where they sit.
“PHP underpins websites and applications across many organizations and their suppliers, so checking the corporate website alone is not enough.
“Organizations need to establish where they are exposed and prioritize internet-facing systems.
“This is a test of operational resilience, not just patch management,” she added.
Phillip Wylie, Chief Security Evangelist, Suzu Labs:
ㅤ
“One of the biggest challenges with vulnerabilities this old is that the people who originally deployed and maintained these systems may no longer be with the organization. Documentation may be outdated or nonexistent, and current security teams may not even know these systems are running.
“Before organizations can patch vulnerabilities, they need visibility into what’s in their environment. That means identifying affected systems, understanding their business impact, and prioritizing those exposed to the internet.
“Patching is important, but it’s not always straightforward with legacy applications. Organizations need to assess the potential impact of updates, implement compensating controls where immediate patching isn’t possible, and develop a plan to replace systems that can no longer be securely maintained.
“This is why asset management, vulnerability management, and basic security hygiene are so important. You can’t protect systems you don’t know exist.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“These PHP vulnerabilities highlight two problems. First, releasing a patch doesn’t mean we can fix everything overnight. PHP is embedded in all kinds of devices, including IoT products, where updates may depend on a vendor. And plenty of small businesses use PHP applications because they’re easy to get running. That doesn’t mean those businesses have the staff or technical expertise to keep everything updated.
“Then you have application compatibility. Plugins and other dependencies can require specific PHP versions, so updating the underlying software may break something the business relies on. ‘Just patch it’ sounds great until the update takes down your website.
“And we haven’t even gotten to the AI-assisted vulnerability research behind this. I think we’re going to see more critical vulnerabilities discovered with AI, and potentially less time between discovery and exploitation.
“That’s the part that worries me. Finding vulnerabilities faster doesn’t mean organizations can fix them faster. We’re still struggling to patch the systems we already know are vulnerable. As an industry, we’re not ready for that gap to keep growing.”
ㅤ
Noelle Murata, Chief Operating Officer, Xcape Inc.:
“The discovery of decades-old vulnerabilities in PHP presents a severe operational resilience test for enterprises rather than a routine patch management drill. At its core, this is another case of needing to “patch your stuff.” Because this runtime underpins a vast swath of the Internet and complex supplier ecosystems, the risk extends beyond primary corporate websites into forgotten legacy dependencies where original deployment context is long gone. Popular frameworks exist that are easy to deploy but also vulnerable if configured improperly. This does not necessarily mean that those frameworks are bad, but rather it is easy to deploy them poorly. Security teams must move beyond basic scanning and execute comprehensive asset discovery across all Internet-facing systems to identify shadow infrastructure. Mitigating controls exist to make this threat less severe without completely removing the risk, so there is cautious optimism that organizations can respond effectively. That said, there will undoubtedly be companies that will not respond quickly, so the number of vulnerable hosts will remain high.
“Critical Takeaways:
- Operational resilience requires mapping and securing forgotten legacy infrastructure beyond primary corporate websites.
- Mitigating controls offer cautious optimism, but the slow response from many organizations will keep the count of vulnerable hosts high.
- Vulnerabilities in popular frameworks often stem from rapid but poor configuration rather than inherent flaws in the code itself.
“Hope is not a strategy, but mitigating controls might just buy you enough time to formulate one.”
PHP needs to be patched. I would strongly recommend that you find out if ANYTHING uses PHP and take the action that is requires ASAP.
Nearly 13,000 exposed refrigeration services raise cybersecurity concerns for hospitals
Posted in Commentary with tags Forescout on October 24, 2026 by itnerdNew research from Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories, raising concerns about cybersecurity risks to hospitals and other facilities dependent on temperature-controlled storage.
Researchers warned that attackers could exploit weak authentication or software vulnerabilities to manipulate refrigeration temperatures, defrost cycles and alarms. In hospitals, similar attacks could threaten the storage of temperature-sensitive medications, vaccines and medical supplies, potentially resulting in product losses and disruptions to patient care.
The findings follow cyberattacks affecting more than 700 French supermarkets, where attackers reportedly manipulated refrigeration controls and caused food losses. Forescout also found that 80% of observed Danfoss StoreView services were running older firmware potentially affected by known vulnerabilities. The research identified exposed systems, not confirmed hospital compromises.
ㅤDamon Small, Board Member, Xcape Inc.:
“Unprotected refrigeration controllers represent an immediate threat to clinical operations and patient safety, where even slight temperature variations can spoil irreplaceable lab specimens, degrade critical pharmaceuticals, and interrupt acute care. The recent discovery by Forescout of nearly 13,000 Internet-exposed refrigeration services across 99 countries demonstrates that operational technology perimeters remain dangerously porous. These exposures are no longer merely theoretical. As documented in intelligence on groups like the Z-Pentest Alliance, politically motivated hacktivists increasingly target civil and commercial cooling infrastructure to intimidate populations and create societal strife, as seen in attacks across hundreds of French supermarkets. In a hospital setting, unauthorized manipulation of defrost cycles, temperature setpoints, or alarm thresholds can silently compromise life-saving inventories without triggering physical alarms in time. Security leaders must treat environmental controls as critical operational assets: audit external exposure, eliminate direct Internet connectivity, place management interfaces like Danfoss StoreView behind an authenticated virtual private network (VPN), and enforce strict network segmentation.
Critical Takeaways:
“If an industrial chiller is easier to access from the Internet than your patient portal, your security architecture has melted.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Nearly 13,000 refrigeration systems reachable from the public internet across 99 countries is the picture underneath incidents the industry has already seen this year.ㅤ
“The attack on Nichirei Logistics in Japan this summer disrupted deliveries to thousands of customers, and similarly, the attack on Danfoss refrigeration controllers in France earlier this month hit 700 supermarkets through manipulated temperature controls. Both ran on the same condition this research just quantified, and the pattern is still accelerating.
“For hospitals, cold chain integrity was built around physical reliability. The controllers running temperature-sensitive medication and vaccine storage were never designed assuming someone would be changing the setpoint on purpose. Any facility operating refrigeration this way should know which units are reachable from the internet, what their patch status actually is, and what happens if the primary temperature control stops responding on a weekend. A pentest of the refrigeration environment, specifically what an attacker could reach and change from the controllers themselves, is the right way to answer those questions before someone else answers them during an incident.”
Hospitals are low hanging fruit for threat actors. And it’s a symptom of a larger problem. One that needs fixing ASAP.
Leave a comment »