🚨PHP2Shell: Critical Vulnerabilities in Core PHP Affect 70% of Sites
70% of websites at risk from PHP2Shell
TL;DR
PHP2Shell, a family of critical vulnerabilities in core PHP, affects 70% of websites, including WordPress, Drupal, and MediaWiki. Unpatched sites are at risk of unauthenticated code execution and sensitive data exposure.
PHP2Shell is a family of critical vulnerabilities in core PHP, reaching a severity of CVSS 9.2. These vulnerabilities allow unauthenticated attackers to execute code or expose sensitive process memory, impacting approximately 70% of websites, including platforms like WordPress, Drupal, and Wikipedia's MediaWiki. Websites can be affected even if their application code is secure. The PHP team responded swiftly, delivering comprehensive fixes for each affected PHP version. The first fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, available from php.net.
Key Points
PHP2Shell vulnerabilities allow unauthenticated attackers to execute code or expose sensitive data, reaching CVSS 9.2 severity.
Vulnerabilities affect PHP versions 8.2 and below, 8.3 and below, 8.4 and below, and 8.5 and below.
First fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, available from php.net.
Disabling PHP error display and fatal-error backtraces can reduce additional information-disclosure paths.
Hardening after upgrading involves reviewing operational effects on the application as part of the upgrade process.
Why It Matters
If you're running WordPress, Drupal, or MediaWiki, PHP2Shell vulnerabilities put your site at risk of unauthenticated code execution and sensitive data exposure. Upgrade PHP to the latest fixed releases to protect your site.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.