CriticalCVE
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
The Hacker News·Source published ·1 min read
What happened?
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.
Key details
- PHP will release an out-of-cycle security update today at 14:00 UTC for two critical remote code execution vulnerabilities rated CVSS 9.2.
- Researchers at watchTowr confirmed the leaked information about two PHP RCE flaws under embargo, but cannot share technical details yet.
- A leak on October 20 claimed CVSS 10.0 flaws affecting PHP 5 onward with CVE identifiers, but PHP's official rating is 9.2 and affected versions remain unconfirmed.
- Mallory found approximately 884,000 internet-facing hosts reporting PHP 8.1 or older via Shodan, representing 59% of version-reporting hosts.
Affected
- PHP branches 8.2, 8.3, 8.4, and 8.5 are supported and can receive the fix.
Fixes and mitigations
- Upgrade internet-facing systems first; check Linux distributions and hosting providers for backported packages.
What to look for
- Monitor for php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools.
- Look for web shells, new files in web root, new cron jobs, scheduled tasks, and unauthorized accounts.
- Florian Roth's process-watcher logs every program a PHP process starts with its command line on Linux.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.