PHP2Shell: two critical PHP flaws, governments take sites offline

On October 20, PHP developers warned about two critical vulnerabilities nicknamed PHP2Shell. PHP runs a large share of the web: WordPress, Drupal, Joomla, Magento and many other systems.

According to Help Net Security, the flaws let an attacker take over a server with a single request, without a password. Every PHP installation serving websites is at risk. The severity score is 9.2 out of 10.

What is happening

On October 21, fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. For the older 7.4, 8.0 and 8.1 branches the developers published a source-code fix, and some hosting providers are shipping their own updates.

Cybersecurity agencies in Europe, the UK, Australia and Japan urged organizations to update or take sites offline. Finland took government websites offline as a precaution, Yle reports. According to Reuters, government agencies in the Netherlands did the same. Cloudflare reports early attacks.

What to do

Updating WordPress or plugins will not help; PHP itself must be updated on the server. That is usually the host's job, so ask them directly whether the fix is installed.

The weakest point is not the main site, which will be updated quickly, but forgotten ones: an old landing page, a past promo site, a blog nobody remembers the password to. As I wrote recently, these are exactly the systems AI agents find first. List all your sites and get an answer from your host for each one. Whatever you do not need is easier to switch off.

Sources: Help Net Security, Yle, Reuters via Global News.