PHP has released security patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities known as PHP2Shell. These flaws allow unauthorized remote access to servers. Because PHP does not update automatically, administrators must manually install these patches and restart their server software to secure their systems.
The impact of these vulnerabilities is significant, as PHP powers approximately 70% of websites with known server-side languages. While official support for PHP 8.1 and earlier has ended, the security team provided manual patches for versions 7.4, 8.0, and 8.1. Security firm Mallory estimates that roughly 884,000 internet-facing hosts are currently running versions that lack official automated fixes.
Exploitation attempts surged following the public disclosure. Cloudflare reported millions of attempts, with activity scaling from thousands before the announcement to millions shortly thereafter. Amazon noted that its decoy servers recorded exploitation attempts as early as October 17, four days before the official disclosure. Despite the high volume of attempts, no confirmed data breaches have been reported.
The PHP Foundation acknowledged that the delay in addressing the vulnerability was a structural failure, citing internal decision-making processes and resource constraints. Moving forward, the foundation will shift from a consensus-based security decision model to a majority-vote system. The organization remains reliant on a small group of funded developers and volunteers for critical security maintenance.
