OCPP Security: Lessons from PHP2Shell Vulnerabilities for Charging Networks

Millions of websites were exposed. Here’s what your charging network can learn from it.

Two critical PHP flaws, known as PHP2Shell, put a large share of the world’s websites at risk of remote takeover. While charging points and our platform do not run PHP, the broader lesson remains clear: serious flaws are being found faster than ever, and anything with old software or an open, unprotected connection is an easy target. For a charging network, the first fix is OCPP Security Profile 2.
‍

More flaws, found faster

The PHP project shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, a pair of memory-safety bugs known as PHP2Shell. Every PHP release back to 5.4 is affected, and both allow unauthenticated remote code execution. Supported branches got a patch; older branches may never get one.

News of the flaws leaked before the patch was out, exploitation attempts started before public disclosure, and some universities and companies cut their own servers off the network until they could update. Fast exploitation isn’t new. What has changed is the volume: with AI tools, serious flaws are found at a much higher rate, so the next one is never far away.
‍

Why the connection matters

The Optimile platform doesn’t use PHP and was not affected. But the incident is a good moment to look at how charging devices connect.

Every charging device, from any manufacturer and on any platform, stays connected to its backend through OCPP. That connection carries charging sessions, configuration and firmware updates, which is why the OCPP standard defines security profiles to protect it.

Without encryption, that data is at risk. Encryption and a unique authentication key per charging device close that gap, and they’re exactly what OCPP Security Profile 2 adds.
‍

Profile 2 is the realistic baseline

The OCPP security specification defines three security profiles for the link between charging device and backend.

Profile 3 is stronger, but it needs a certificate on every charging point and a process to manage them. Profile 2 works on most current hardware, needs no per-charging-point certificates, and removes the two biggest risks at once: readable keys and fake backends.

‍

Start with new charging devices, then migrate the rest

It is critical that every new charging device goes live on Profile 2 from day one. Once that baseline is set, existing devices can be migrated step by step. Over the coming months, we will reach out with a clear overview, guides, and updates to help you plan each phase effortlessly.

1. Commission every new charging device on Profile 2. Make Profile 2 support a mandatory purchasing requirement for all new hardware. During commissioning, set a unique authentication key and connect using wss://. Every new charging device you install this way is one you never have to migrate.
2. Map your existing fleet. List every installed charging device with its model, firmware version, OCPP version and current security profile. Charging devices that cannot do Profile 2 go on a firmware or replacement list.
3. Update firmware first. Security support usually arrives with firmware, and old firmware means old TLS libraries. Patch before you switch, so the switch doesn’t leave the charging device unable to connect.
4. Give every charging point its own authentication key. Generate a unique key per charging point, at least 16 characters. No shared fleet keys, no factory defaults. Rotate it when a charging location gets a new host or operator.
5. Move to wss:// with a trusted certificate. Use TLS 1.2 or newer and a certificate from a certificate authority (CA) the charging point already trusts. Track its expiry date: an expired backend certificate disconnects every charging point at the same moment.
6. Switch, then block the old connection. Set the new profile through the charging device’s configuration, confirm it reconnects over wss://, and then refuse unencrypted and lower-profile connections for that charging device. A charging device that can fall back to Profile 1 is still on Profile 1.
7. Watch the security events. Log failed logins, certificate errors and unexpected reconnects. A burst of failed authentications on one charging point ID is your early warning that someone is trying.
   ‍

Together for a more secure future

Security is an ongoing process and a shared effort between installers, manufacturers, CPOs and software platforms like Optimile. Profile 2 is a step we take together, starting with the next charging device you install. Want to know where your network stands today? Talk to your Optimile account manager.

‍