Ethical Hacking News
PHP, a widely used server-side scripting language, has released emergency patches for two critical vulnerabilities, dubbed PHP2Shell, which can allow an attacker to execute arbitrary code on a web server without prior authentication. The vulnerabilities, rated 9.2 on the CVSS v4.0 scale, are located in the PHP runtime and can be exploited by attackers to read sensitive data, including passwords, authentication tokens, and certificates, without gaining code execution. This article provides an in-depth look at the PHP2Shell flaws, their impact on web security, and the steps organizations can take to protect themselves from these critical vulnerabilities.
PHP has released emergency patches for two critical vulnerabilities, dubbed PHP2Shell, which allow attackers to execute arbitrary code on a web server. The vulnerabilities, rated 9.2 on the CVSS v4.0 scale, can be exploited to read sensitive data, including passwords and certificates, without prior authentication. The PHP team has released patches for PHP versions 5.4 to 8.5.12, but updating individual applications or websites does not update the PHP runtime. The flaws can be exploited to read memory from the PHP worker process, which may hold sensitive data, making it particularly concerning. Updating the PHP runtime is the only complete fix, and other measures, such as setting memory limits, can reduce exposure but do not make a server safe. The PHP team acknowledges that the delay in releasing the patches was due to a "structural failure" of its decision process and resources. The leak of vulnerabilities' details ahead of the planned disclosure date led to early exploitation attempts. Organizations are advised to take proactive measures to protect their systems from cyber threats and keep software up to date.
PHP, a widely used server-side scripting language, has released emergency patches for two critical vulnerabilities, dubbed PHP2Shell, which can allow an attacker to execute arbitrary code on a web server without prior authentication. The vulnerabilities, rated 9.2 on the CVSS v4.0 scale, are located in the PHP runtime and can be exploited by attackers to read sensitive data, including passwords, authentication tokens, and certificates, without gaining code execution.
The PHP2Shell flaws were discovered by researchers at Wiz, California, and OpenAI, who worked with the PHP security team and Google's Gemini team to develop a fix. The vulnerabilities were found in PHP versions 5.4 to 8.5.12, and the PHP team has released patches for the affected versions. However, the team warns that updating the PHP runtime is the only complete fix, as updating individual applications or websites does not update the PHP runtime.
The flaws are particularly concerning because they can be exploited by attackers to read memory from the PHP worker process, which may hold sensitive data. The researchers demonstrated this reading of live worker memory against applications they did not control, making it independent of the application running on top of PHP. This means that even a simple "Hello World" page on a vulnerable PHP version can be attacked.
The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs. The PHP team has advised that updating the PHP runtime is the only complete fix, and that other measures, such as setting memory limits or enforcing request-size limits, can reduce exposure to specific attack paths but do not make a server safe.
The PHP security team has also acknowledged that the delay in releasing the patches was due to a "structural failure" of its decision process and resources. The team has since changed its approach to security decision-making and has added staff and tooling to catch similar problems sooner.
The leak of the vulnerabilities' details ahead of the planned disclosure date has been cited as a factor in the early exploitation attempts. Cloudflare has reported seeing early attempts to exploit the flaws, and some organizations have taken services offline as a precautionary measure.
The PHP2Shell flaws highlight the importance of keeping software up to date and the need for organizations to take proactive measures to protect their systems from cyber threats. As the threat landscape continues to evolve, it is essential for organizations to stay informed and take steps to mitigate the risks associated with these types of vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/PHPs-Critical-PHP2Shell-RCE-Flaws-A-Global-Cybersecurity-Alert-ehn.shtml
https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
https://en.wikipedia.org/wiki/PHP2Shell
Published: Wed Oct 21 12:42:50 2026 by llama3.2 3B Q4_K_M
