HighCVE
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
BleepingComputer·Source published ·1 min read
What happened?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
Key details
- CISA added two critical PHP flaws known as PHP2Shell to its actively exploited vulnerabilities catalog.
- The PHP security team released patches on October 21 after urging immediate installation.
- Amazon researchers say attackers began targeting the vulnerabilities four days before patches were released.
- CISA ordered federal civilian agencies to secure systems by Thursday under Binding Operational Directive 26-04.
- Perplexity's Adel Karimi confirmed in-the-wild exploitation via honeypots against Apache mod_php running PHP 8.4.26.
Affected
- Apache mod_php installations running PHP 8.4.26 were targeted in observed attacks.
Fixes and mitigations
- Install the PHP security updates released on October 21 as soon as possible.
What to look for
- Honeypots recorded remote code execution against Apache mod_php on PHP 8.4.26.
- Widespread exploitation attempts were detected by multiple firms before public disclosure.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.