PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Original title: Even after PHP2Shell, blast radius matters more than a CVSS score
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
An opinion piece sponsored by Token Security argues that enterprises cannot patch at machine speed after PHP2Shell and should instead reduce blast radius by governing identities. It recaps that attackers exploited the two PHP flaws before and on disclosure day, and that CISA added them to its exploited-vulnerability list on October 26. The author says remediation will be slow because PHP ships in unpatchable appliances and versions 8.1 and older got no official builds, and recommends treating identity as the control plane.
Unconfirmed: The 32.5 million vulnerable-service figure and remediation-time statistics come from Censys, Verizon and Qualys and are not independently verified.
- The PHP flaws date to 2012 and were found by Calif and Wiz with AI model assistance.
- CISA added both flaws to its exploited-vulnerability list on October 26.
- Censys counted 32.5 million internet-facing PHP services on vulnerable versions.
- Verizon's 2026 DBIR states median time-to-fix of an exploited vulnerability is 43 days.
- Vendors
- PHPToken Security
- Countries
- United States
From the original article
4 min read at bleepingcomputer.com
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]
By Sponsored by Token Security · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.