PHP issues emergency patches for critical zero day flaws dubbed php2shell

The PHP Foundation released emergency patches on October 21 for two critical zero day vulnerabilities in PHP core. Cisco Talos and Recorded Future both report that the flaws, dubbed php2shell, permit unauthenticated attackers to execute remote code. According to Cisco Talos, the security issues can be triggered using a simple HTTP request before any application code executes. [1][2][4]

The two vulnerabilities carry a CVSS severity score of 9.2, according to CSO Online and Recorded Future. Recorded Future reported that the PHP security team initially announced an out of band security release on October 20. Cisco Talos notes that the flaws affect every PHP build since version 5.4, putting a vast portion of the internet at risk. [1][2][4]

Security monitoring firms have already detected threat activity surrounding the vulnerabilities. According to GBHackers News, Cloudflare warned of active exploitation attempts targeting the leaked flaws. Recorded Future also reported that public proof of concept exploits and active exploitation attempts have been observed. [4][7]

Organizations are urged to apply the official emergency patches immediately to prevent unauthorized systems access. CSO Online noted that immediate patching is imperative for affected deployments. Cisco Talos has released Snort detection rules, including updates in its Community Ruleset, to help security teams identify potential attacks. [1][2]