🔴 Critical: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
-
PHP has pushed out emergency updates addressing two critical vulnerabilities in the PHP language itself that could allow an unauthenticated attacker to execute code on a web server. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and according to the PHP team, only applying the update provides full protection for a server.
The two flaws, collectively tracked as PHP2Shell, reside in the PHP runtime rather than in any application layer. This means a site can be exposed even when its own code is not at fault, since the weakness exists beneath whatever application is running on top of the interpreter.
Key points for defenders:
- The vulnerabilities are unauthenticated, requiring no account or credentials to exploit.
- Because the flaws sit in the runtime, patching the application code or hardening the site will not remediate them.
- The affected update branches are 8.5.x, 8.4.x, 8.3.x, and 8.2.x, with fixes landing in the point releases listed above.
- The PHP team's guidance is clear: updating is the only complete protection.
If your organization runs PHP in any capacity, treat this as urgent and verify which version your servers and containers are running before the weekend.
Source: [email protected] (The Hacker News)
Has your team already confirmed which PHP versions are running across your environments, or are you still mapping affected hosts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login