From php2shell to Hacked Refrigeration Systems: What Recent Cyberattacks Reveal About Software Supply Chain Security

Gray shield icon featuring the text "PHP" and a checkmark inside.

Software vulnerabilities such as “php2shell” and the recent cyberattacks on refrigerator systems across Europe highlight the importance of transparency about the software components in use and professional vulnerability management. For critical infrastructure operators and NIS-2 entities in particular, this raises a key question: How quickly can they determine whether their systems are affected and what measures are required?

Manufacturers can make an important contribution through clear processes, a software bill of materials (SBOM), and specific security advisories.

NIS-2: Incident management and supply chain security
The European NIS-2 Directive addresses, among other things, two key requirements for cybersecurity risk management:

  • Incident handling and prevention (incident management): Security incidents must be detected, assessed, and handled according to defined processes. This includes appropriate measures to limit their impact and prevent similar incidents.
  • Supply chain security: Cyber risks must also be considered in relation to direct suppliers and service providers, as well as the products and software components in use.

For critical infrastructure operators and NIS-2 entities, this means that their cybersecurity does not depend solely on their internal IT systems. Software components and dependencies within the supply chain must also be included in security assessments.

“Software supply chain security begins with transparency about the components in use and extends to the professional handling of specific security incidents.”

Jürgen Seiler, Head of Business Development at Dallmeier electronic GmbH & Co.KG

How we support software supply chain security as a manufacturer
The software vulnerability “php2shell,” publicly disclosed in October 2026, illustrates the importance of cooperation between manufacturers and operators. Manufacturers can support their critical infrastructure and NIS-2 customers in three areas in particular:

1. Clear vulnerability management processes
Structured vulnerability management helps assess newly disclosed vulnerabilities, investigate their potential impact on the manufacturer’s own products and, consequently, on customers, and initiate the necessary measures. This also includes the manufacturer’s own incident management: Security-related events must be handled internally and, where necessary, addressed through appropriate information and measures for customers.

2. Transparency through a software bill of materials (SBOM)
An SBOM documents the software components that make up a product. When a vulnerability is disclosed, this transparency can help identify potentially affected components more quickly and enable a more targeted assessment of whether a product is affected. An SBOM is therefore an important analytical tool – but it does not replace technical testing or an assessment of the actual exploitability of a vulnerability.

3. Specific guidance and instructions for action
In the event of a security incident, operators need clear, reliable information: Is a product affected? What measures are recommended? Are updates or other mitigation measures available? Clear security advisories and specific recommendations for action help customers assess risks and respond appropriately.

Cybersecurity as a shared responsibility
Software supply chain security is not a one-time assessment, but an ongoing responsibility for manufacturers and operators. It begins with transparency about the components in use and extends from vulnerability management to the structured handling of specific security incidents.

Illustration of a map of Europe with industrial imagery incorporated, featuring the text "ACT NOW!" in bold orange at the top left.

Dallmeier’s “Act Now” initiative:
With its “Act Now!” initiative, Dallmeier helps critical infrastructure operators and NIS-2 entities better understand regulatory requirements and strengthen their digital, physical, and geopolitical resilience. Practical guides, whitepapers, and webinars provide guidance on cybersecurity, supply chain risks, and cybersecure video security technology.

Conclusion:
The “php2shell” vulnerability and attacks on refrigeration systems illustrate the risks of weaknesses in connected software and operational technology. Transparency through SBOMs, structured vulnerability management, and specific recommendations for action help operators and manufacturers work together to assess risks more quickly and handle security incidents professionally. Supply chain security thus becomes an important element of cyber resilience for critical infrastructure operators and NIS-2 entities.

Further information

About the Author: