🚨PHP2Shell Vulnerabilities Exploited at Scale, Millions of Attempts
Millions of PHP2Shell Attacks, Millions of Vulnerable Sites
TL;DR
PHP2Shell vulnerabilities are being exploited at scale, with millions of attempts since public disclosure. Cloudflare and Amazon warn of widespread risk, urging investigation of suspicious activity from October 17 onwards.
Attackers are targeting PHP2Shell vulnerabilities with millions of attempts since the flaws were publicly disclosed. Cloudflare reported thousands of exploitation attempts in the 10 hours before the vulnerabilities were announced, jumping to tens of thousands within 45 minutes and hundreds of thousands within two hours. The PHP Foundation has accused Chainguard of putting websites at risk by publishing patched PHP builds early. If you're running PHP-based sites, this is a big deal. The vulnerabilities carry a critical 9.2 severity rating and affect PHP's handling of memory, putting potentially millions of websites at risk. Cloudflare has deployed WAF protections across its free and paid plans, but smaller sites may not have the same level of protection.
Key Points
Cloudflare detected thousands of PHP2Shell exploitation attempts in the 10 hours before public disclosure on October 21.
Attack attempts jumped to tens of thousands within 45 minutes and hundreds of thousands within two hours of disclosure.
Multiple proof-of-concept exploits were detected on October 21, some 12 hours before patches were released.
The PHP Foundation accused Chainguard of putting websites at risk by publishing patched PHP builds early, before the agreed disclosure deadline.
Cloudflare has deployed WAF protections across its free and paid plans to mitigate the risk.
Why It Matters
If you're running PHP-based sites, PHP2Shell vulnerabilities are a critical issue. The bugs affect the PHP runtime itself, putting potentially millions of websites at risk. Cloudflare has deployed WAF protections, but smaller sites may not have the same level of protection. Investigate suspicious activity dating back to at least October 17.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.