PHP Maintainers Rush Emergency PHP2Shell Patches as Attacks Begin

Several cybersecurity agencies, including the NSA, urged organizations to shut down affected systems while they install the updates. Many municipalities, schools and private companies followed that advice, according to the report. Cloudflare Inc. and Fastly Inc. said hackers are already trying to exploit the bugs.

“This is not a theoretical vulnerability,” Fastly chief product officer Kelly Shortridge said. “We observe many billions of PHP requests a day across Fastly’s global network, and we are seeing evidence of active attacks.”

PHP2Shell allows hackers to deploy malicious code on vulnerable servers, sometimes in a few seconds. Once malware compromises a website, it can read the site’s database and launch cyberattacks against visitors.

The first exploit occurs when a piece of PHP code receives more data than it can process. PHP responds by deleting some of the ingested data, and the maintainers said the leftover data can be used by hackers to launch attacks. The second relates to global state, information shared by multiple components of a program and associated with a specific request. When an application processes a request, it deletes the associated global state; PHP2Shell lets malicious code access some of that data before deletion, opening the door to attacks.

“This is about as broad as a critical vulnerability gets,” said Moshe Siman Tov Bustan, a cybersecurity research team lead at OX Security Inc. “If you have a publicly accessible PHP instance and haven’t patched it, start from the assumption that you’re exposed. If you find evidence of exploitation, assume compromise, not just exposure.”

The underlying technical issue had been in PHP for decades, but researchers believed it could not be exploited in practice. That changed in August, when an employee of Calif.io Inc. used GPT-5.6 Sol to scan PHP’s code base for bugs. The audit, financed by OpenAI Group PBC, revealed that PHP2Shell could be targeted. Google LLC’s Wiz cybersecurity unit made additional discoveries shortly afterward.

Over the following weeks, technology firms and cybersecurity researchers formed an industry group to address PHP2Shell. The effort produced more than 10,000 lines of code and fixes spanning more than 20 PHP files, according to the report. The consortium had planned to release the patch on Thursday, but the vulnerability leaked a day earlier on a popular developer forum, prompting PHP’s maintainers to rush out the fixes.

“A leaked embargo is a leadership test as much as a technical one, because the decisions that matter today get made before anyone has full details,” said Andrew Obadiaru, chief information security officer of Cobalt Inc. He said security leaders need to answer quickly where PHP is running, who owns each system and who has authority to take a system offline if it cannot be patched.

Itai Goldman, co-founder and chief technology officer of Miggo Ltd., said PHP has been embedded in websites, applications and third-party software for decades, and many organizations still run older versions that no longer receive standard security updates. “For those systems, ‘drop everything and patch’ isn’t always an option,” he said. “Security teams need to identify their exposure now, prioritize internet-facing systems and work with vendors on upgrade paths or supported fixes.”

Cloudflare updated its content delivery network to shield customer websites from PHP2Shell attacks, but stressed that users should still patch their systems. CrowdStrike Holdings Inc. and several other enterprise cybersecurity providers added mitigations to their products. OpenAI released a tool to help users of its Codex coding assistant find vulnerable PHP installations in their systems.