Patch PHP Systems Immediately as Hackers Exploit Critical PHP2Shell Flaws

PHP maintainers released patches today for two critical vulnerabilities that affect up to 70% of the world’s websites, according to SiliconANGLE. Cybersecurity agencies including the NSA are urging organizations to shut down affected systems while they implement the updates. Many municipalities, schools and private companies have taken this advice to secure their infrastructure against immediate threats.

The exploits, known as PHP2Shell, enable hackers to deploy malicious code on vulnerable servers in seconds. Once compromised, the malware can read website databases and launch attacks against visitors. Content delivery network operators Cloudflare and Fastly reported that hackers are already trying to exploit these bugs, with Fastly noting evidence of active attacks across its global network.

What we know

The first exploit occurs when PHP code receives more data than it can process, causing the system to delete some ingested data. Hackers can use the remaining data to launch cyberattacks, according to the language’s maintainers. The second exploit relates to global state information shared by multiple program components. PHP2Shell allows malicious code to access this data before it is deleted, opening the door to further attacks.

The underlying technical issue has existed in PHP for decades, but researchers previously believed it could not be exploited in practice. That changed in August when an employee of Calif.io used GPT-5.6 Sol to scan PHP’s code base for bugs. OX Security researcher Moshe Siman Tov Bustan stated that any publicly accessible unpatched PHP instance should be assumed exposed.

Defender's checklist

• Verify if your servers run vulnerable versions of PHP that lack the recent patches.
• Monitor server logs for unusual data deletion patterns or unexpected global state access.
• Check for unauthorized code execution or database reads following recent server requests.
• Confirm that content delivery network providers have applied necessary mitigations for your domain.

What analysts watch for

Teams usually examine server logs for rapid, automated requests that trigger data truncation errors or abnormal global state behavior. Analysts check whether unauthorized scripts have been written to the file system shortly after such errors occur. They also look for outbound traffic from web servers that suggests data exfiltration or command-and-control communication. Persistence mechanisms often involve modified configuration files or hidden cron jobs that reinstall malicious payloads after reboots. Spread typically occurs through lateral movement using stolen credentials or by injecting malicious code into public-facing pages that serve visitors.

What to do and how to stay safe: PHP

• Apply the latest PHP patches immediately to all production and development servers.
• Shut down publicly accessible PHP instances if you cannot patch them within hours.
• Monitor server logs for signs of active exploitation, such as rapid data processing errors.
• Assume compromise if you find evidence of exploitation, not just exposure.

Step-by-step guide: Security Advisories: Small Business Patching Strategy

General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the collective name for two critical vulnerabilities in PHP that allow hackers to deploy malicious code on vulnerable servers.

How widespread is this vulnerability?

The vulnerabilities affect up to 70% of the world’s websites, according to the PHP maintainers.

Are these vulnerabilities currently being exploited?

Yes, Cloudflare and Fastly reported that hackers are already trying to exploit these bugs, with Fastly observing evidence of active attacks.