Critical PHP “php2shell” Vulnerability Triggers Mass Exploitation Attempts

PHP stands for PHP: Hypertext Preprocessor. It is a programming language that runs behind the scenes on a website’s web server, helping sites display dynamic content and applications.

When you visit a website, PHP code collects data and transforms it into web pages that users can read. Developed in the early 1990s, PHP remains widely used across the internet.

What Is PHP Used For?

PHP powers a wide range of platforms, including Wikipedia, online shops and WordPress, the content management system behind many websites. It is also used to create tools for building web applications.

Popular PHP frameworks include Laravel, Symfony and Drupal.

What Is the “php2shell” Vulnerability?

Cybersecurity company Wiz, external helped discover a critical vulnerability in PHP, which the company says powers 70% of the world’s websites. The vulnerability surfaced this week.

The flaw, now called “php2shell”, is inherent in the language itself and has affected many past versions, according to the report.

The PHP Foundation, the nonprofit organization that maintains the programming language, warned that under the right conditions, an unauthenticated attacker could remotely execute code on a server running PHP.

Organizations Report Exploitation Attempts

Some large organizations said they had witnessed a large number of attempts to break into their systems.

Matthew Prince, president of internet infrastructure company Cloudflare, wrote on X, external that Cloudflare had seen “thousands” of attempts to exploit the PHP vulnerability across its network during the 10 hours before the vulnerability was made public.

“Within 45 minutes of the announcement, we had tens of thousands of people, within two hours we had hundreds of thousands of people, and now we’re in the millions,” he added.

Amazon also said it had witnessed hackers attempting to exploit the flaw, although its website was operating normally.