PHP Foundation knew of PHP2Shell flaw for two years before emergency patch
The PHP Foundation’s post-mortem says a developer spotted the underlying memory flaw in 2024, but maintainers did not agree on a fix while trying to preserve compatibility with extensions. Researchers later demonstrated that the flaws could enable unauthenticated remote code execution, prompting emergency patches on 21 October; PHP says updating is the only reliable fix.
Bottom line — Censys counted about 29 million unpatched services, though hidden version data and backported fixes make the total uncertain.
Go deeper 7
-
Tom’s Hardware reports the Foundation has one full-time employee and 14 part-time contractors maintaining PHP.
-
The PHP Foundation rated both disclosed vulnerabilities 9.2 out of 10; the flaws affect PHP’s request handling and memory management.
-
Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, according to the PHP advisories.
-
PHP published source backports for versions 7.4, 8.0 and 8.1; older installations may need vendor packages or an upgrade, Tom’s Hardware reports.
-
CERT-EU’s tracking repository lists 215 vulnerable and 185 fixed products among 948 products it tracks.
-
TechTarget reports that European government sites and other organisations temporarily took websites offline while patches were prepared.
-
Dream researchers say an attacker chained PHP2Shell with a kernel exploit to compromise 25 PAN-OS servers; Palo Alto Networks’ Unit 42 independently verified the tooling and results.