PHP2Shell exploitation surges while most public PHP stays unpatched
Original title: Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
Researchers say attackers began exploiting critical PHP flaws dubbed PHP2Shell faster than organizations applied fixes. Cloudflare's chief executive reported attempts climbing into the millions within hours of the October 21 disclosure. Scanning firms found nearly all discoverable instances still not advertising patched releases a day later, including many on unsupported branches. Practitioners say updating is often harder than a simple version change; the article's specific steps are cut off.
Unconfirmed: Attempt volumes and the worldwide 10% figure are claims by Cloudflare's CEO and Check Point; scanners note internet data misses nuances.
- Matthew Prince said attempts rose from thousands before disclosure to millions by late October 21.
- Check Point Research said exploitation attempts had reached 10% of organizations worldwide.
- Ox Security said 97.5% of sampled Shodan instances still lacked a patched version on October 23.
- Flare said about 5% of upstream-supported public records had been updated.
- Cisco Talos estimated from OSINT that around half of PHP systems will not get patches.
Impact: Exploitation of critical PHP vulnerabilities
| Product | Affected |
|---|---|
| PHP Foundation PHP | — |
- 1.Apply a newly released patched PHP version where the deployment can be updated.
- Products
- PHP
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1d1c29eff49426577dcf3e84cf3b98ff | k-openclaw-cline-users#recipe=similar-items&sourcecontentid=1d1c29eff49426577dcf3e84cf3b98ff) Supply Chain Attack Secretly Installs OpenClaw for Cline |
| md5 | 1e51d280261e34e0cc1db58fc4422dce | tepad-updates-6-months#recipe=similar-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by |
| md5 | 208b9846191967c692e5c2bf1e972959 | ay-light-patch-tuesday#recipe=similar-items&sourcecontentid=208b9846191967c692e5c2bf1e972959) Microsoft Fixes Exploited Zero Day in Light Patch Tuesday |
| md5 | 5f19c8eeeb93473c11fd921316903dea | iden-era-sbom-guidance#recipe=similar-items&sourcecontentid=5f19c8eeeb93473c11fd921316903dea) Trump Administration Rescinds Biden-Era Software Guidance |
From the original article
10 min read at darkreading.com
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
By Nate Nelson · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.