PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the two vulnerabilities known as PHP2Shell, but server owners must install them and restart PHP or websites will remain exposed. Cloudflare recorded thousands of attempts before the announcement, tens of thousands within 45 minutes, hundreds of thousands within two hours and millions since, while Germany and Japan reported no confirmed successful intrusions. The PHP Foundation acknowledged a “structural failure” in its decision-making process and lack of resources, which delayed the fix for the first issue identified in 2024. Roughly 884,000 exposed servers run PHP versions with no official patch, no cryptocurrency exchange has reported a breach linked to PHP2Shell, and weak passwords, missing two-factor authentication and unverified links remain the main risks for users.
Source: Read the original article
