PHP2Shell: Patches Released as Vulnerable Servers Persist

PHP has released patches for the PHP2Shell vulnerabilities, but servers remain at risk until operators install the updates and restart PHP. The flaws, rated 9.2 out of 10 for severity, can allow attackers to run code on web servers without logging in. Details and exploit tools surfaced before the patches were released on 21 October, prompting government agencies and major services in several countries to take websites offline as a precaution. Cloudflare CEO Matthew Prince reported millions of PHP2Shell exploit attempts. Germany’s BSI and Japan’s government said they had not confirmed successful attacks, while Amazon said a decoy server recorded an attempt on 17 October, before public disclosure. The PHP Foundation said it first found signs of one flaw in 2024 and called the delay in fixing it a “structural failure.” Security firm Mallory counted about 884,000 internet-facing hosts running PHP versions without official fixes. Reports of successful exploitation remain unclear, and some researchers warn attacks could escalate. No crypto exchange or wallet has publicly reported a PHP2Shell-related breach. However, compromised websites could expose credentials, redirect visitors to scams or imitate legitimate crypto services to trick users into approving malicious wallet transactions. The vulnerability affects server software, not users’ devices. Crypto traders should use bookmarked sites and official apps, avoid unexpected update prompts and security-email links, enable two-factor authentication, restrict API keys, verify wallet addresses and prompts, and avoid signing unexpected transactions. Operators of trading bots should also check and update relevant software dependencies.