The PHP Foundation confirmed that a critical vulnerability in the PHP engine, allowing for remote code execution, was known to maintainers for two years. The issue stems from an architectural flaw in error handling involving the longjmp function, which can leave inconsistent data in the memory heap during process failures.
The PHP2Shell exploit is currently being used to target vulnerable servers. At the time of the public disclosure, approximately 73% of online PHP installations were running end-of-life versions. The PHP Foundation operates with a small team consisting of one full-time employee and 14 part-time contractors.
Security firm Censys estimated that 45.7 million out of 119 million PHP installations were initially vulnerable. As of the latest reports, the number of unpatched services has decreased to approximately 29 million, with a patch rate of about 1 million per day. However, 62% of servers have disabled version reporting, complicating accurate tracking.
The vulnerability affects various systems, including network appliances and NAS devices. While the PHP Foundation released patches for versions 7.4 through 8.1, many organizations rely on backported fixes from Linux distributions or third-party developers. Security firms and CDNs like Cloudflare and Fastly have updated their rulesets to detect and block the exploit.
