By now, you’ve probably heard about this PHP vulnerability that has been around for years but only recently discovered. You can get all the gory details about it elsewhere, but I found getting a layman’s explanation of what the problem actually is was not so easy to obtain.
The first order of business, however, is that if you are running a website that uses PHP, you absolutely MUST update NOW.
Plenty of sites cover the details–check your php version from the command window with php -v. The version should show built on or after October 20, 2026. If it does not, and the version is 8.2 or higher, you can get the patch applied either by contacting your web hosting service and have them apply it, or if you are self-hosting on a Linux server, you can apply the update with:
sudo apt update
sudo apt upgrade
If you are using a php version prior to 8.2, then no direct patch is, or will ever be available. You can obtain the patch and compile it yourself into your php version–but that is a technical and can be a complicated process.
You really should update your PHP version to at least 8.2, even at the risk of breaking your website. Better a broken website than a compromised one.
The vulnerability, known as PHP2Shell, allows an attacker to gain root access to your server and execute any code they desire–basically to take full possession of your server. Yes–it is as severe as it sounds.
The short explanation of how an attacker can do this is that by submitting a carefully crafted POST request to your website, the vulnerability can be triggered due to improper memory handling by PHP. The explanation is actually a lot more sophisticated than this–but the point is that the vulnerability is triggered before any of your code can ever execute. This means there is no code that can stop the attack, other than by applying the patch.
Sources:
- PHP2Shell: Critical PHP vulnerabilities patched, update now! – Help Net Security
- PHP2Shell – Wikipedia
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws – SecurityWeek
- PHP2Shell: Critical PHP RCE – Sansec
- PHP Remote Code Execution (PHP2Shell) – watchTowr
- Two Critical PHP Flaws… – Qualys
- PHP2Shell flash report – Abstract Security
Leave a Reply