PHP2Shell flaws let attackers seize servers; patch covers only newer PHP
Cloudflare blocked thousands of exploit attempts, and Chainguard's CEO says a single AI prompt was enough to find PHP bugs independently.
Two PHP vulnerabilities publicly known as PHP2Shell were disclosed this week, exposing servers to takeover and data theft. The PHP Foundation released a patch on October 21 that covers only newer versions of PHP.
Some governments took their websites offline while waiting for a fix, according to windowscentral.com. Cloudflare blocked thousands of attempts to exploit the PHP2Shell bugs, including attempts made before the flaws were publicly disclosed.
Dan Lorenc, CEO of the security company Chainguard, said a simple prompt to a frontier AI model was enough for his team to find PHP vulnerabilities independently of the public disclosure.
Long-standing footprint
PHP has existed for more than three decades and runs nearly 70% of websites that use a known server language, including WordPress, Yahoo, Etsy and Wikipedia.
Quick answers
What is PHP2Shell?
PHP2Shell is the public name for two PHP vulnerabilities that allowed attackers to take over servers and steal data.
Which PHP versions does the patch cover?
The PHP Foundation's patch, released on October 21, covers only newer versions of PHP.
Did anyone stop the attacks?
Cloudflare blocked thousands of exploitation attempts, including some that came before the public disclosure of the bugs.