Barsec Cyber Intel
PHP2Shell: Two Critical PHP Flaws Are Being Actively Exploited
If your website or server uses PHP, two flaws can let an attacker run commands without logging in. Patched versions are available now.
What happened
PHP is the engine behind a huge number of websites and web applications, including many WordPress, Drupal and Joomla sites. These vulnerabilities are in PHP itself, not in a specific plugin or theme. If a server is running a vulnerable PHP version, an attacker can send specially crafted web requests and potentially make the server run commands without needing a username or password. That can lead to stolen data, malicious files being installed, or a website and server being taken over. The risk is no longer theoretical. The vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog and security researchers have confirmed real-world exploitation. This is a patch-now issue for internet-facing PHP systems.
Why this matters
Small businesses often do not manage PHP directly. It may be controlled by a web host, managed provider, control panel, appliance, or the server underneath a WordPress site. Your website software may look fully updated while the PHP runtime underneath it is still vulnerable.
What you should do
- Check which PHP version your website or server is actually running.
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your supported branch.
- If you are on PHP 8.1 or older, move to a supported branch or confirm your OS/LTS vendor has supplied a supported backport.
- If the server was exposed while vulnerable, review it for unusual processes, unexpected files, shells, download tools, or other compromise indicators.