The PHP security team has announced plans to release emergency patches for two critical security vulnerabilities, each rated at 9.2 out of 10 on the CVE severity scale. Information regarding these flaws appears to have been leaked prior to their official disclosure, with a video circulating that allegedly demonstrates a tool named PHP2Shell exploiting the vulnerabilities for remote code execution on web servers.
The PHP programming language is foundational to a vast number of internet websites, making these vulnerabilities a significant concern for web administrators. The update is scheduled for release at 2 p.m. UTC (10 a.m. ET). Cybersecurity firm Sansec has stated that these vulnerabilities affect all web servers running PHP 5.4 and later, predicting that "mass attacks to start within 15 minutes of the release."
In response, Cloudflare's chief technology officer, Dane Knecht, confirmed the company is updating its firewall rules for PHP sites. He noted on X that early attacks are already emerging and that mitigations are being updated as new vectors appear, characterizing these measures as a temporary solution. He urged users to apply the official patch as soon as it is released by the PHP team.
Benjamin Harris, CEO of cybersecurity firm WatchTowr, told Bleeping Computer that the vulnerabilities were initially intended to be disclosed under embargo on Thursday at 11 a.m. ET. He confirmed their authenticity and noted that they are both rated CVSS10 and understood to affect PHP versions 5, 6, 7, and 8.
Web administrators are being advised to take immediate steps, including cataloging all PHP installations, scheduling a maintenance window to coincide with the patch release, and backing up site and database files. This situation marks a significant security event in what has already been a year of sophisticated exploits, highlighting the critical need for prompt patching and vigilance within the web development community.