COMMENTARY: The entire global cybersecurity business is now focused on responding to the PHP2Shell incident.
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Here’s what teams need to know right now:
- Patch right away: If the company runs PHP on anything that faces the internet, stop now and patch it. The fixed releases went out the morning of Oct. 21, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Then restart every PHP site and check the version that's actually running, because a patch sitting on disk protects nothing.
- This one's bad: PHP2Shell is about as bad as a web flaw gets. In the attack already demonstrated against Apache with mod_php, one request triggers the bug before a single line of the application's own code runs. No login. Nothing the developers wrote gets a vote. The PHP project rates both flaws 9.2 under CVSS v4.0, and Cloudflare says it's already seeing early attack attempts.
- The PHP security team got this right: They gave admins advance notice, got the fixes to the Linux distributions early, and shipped a day ahead of the original embargo. It still wasn't enough. Partial details leaked online the day before the release, and unverified exploit code was circulating hours before the fix went public. That's the pattern now. The gap between disclosure and attack is shorter than most organizations' testing cycle, so last quarter's penetration test tells us very little about this week.
- The harder problem is the PHP nobody remembers owning: The PHP project no longer ships releases for 8.1 and older, and old PHP lives in appliances, vendor portals, marketing microsites, container images, and test boxes someone stood up years ago. Those are the systems that stay exposed after the patch ticket closes. The PHP team even published bare-bones source fixes for 7.4, 8.0, and 8.1, which tells you how seriously they take this one.
- WAF rules and configuration changes buy the company hours, not safety: Even Cloudflare calls its own rules a stopgap, and the PHP team says plainly that only the update is a complete fix. If it’s not possible to patch a system today, take it off the internet until it's ready. And for anything that was exposed after the details leaked on Oct. 20, look for web shells and new accounts before the team calls it closed.
Jon Williams, staff security engineer, Bishop Fox
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
