Google Analytics counts our visits, with cookies. No thanks turns it off and removes its cookies; in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, it stays off unless you accept. Cookie Notice

Advertise
PRICES
BTCETHSOLXRPBNBTONDOTLTCPOLHBARNEARARBUNI

← Back to NewsDesk

AI summary of a third-party reportBearishNewsDesk

PHP2Shell fix released as Cloudflare reports millions of exploit attempts

PHP has shipped patched versions of its software to close two flaws nicknamed PHP2Shell, but servers stay exposed until owners install the update and restart PHP.

Why it matters: The flaws sit in software running behind most of the web, and unpatched servers could host fake crypto sites that trick visitors into approving wallet-draining transactions.

InvestIn.News NewsDesk · 1 min read
Share
Picture from Decrypt for: PHP2Shell fix released as Cloudflare reports millions of exploit attempts
Image: Decrypt
Original reporting: Jose Antonio Lanz, Decrypt

Key points

  • Cloudflare's Matthew Prince said exploit attempts rose from thousands before disclosure to millions since.
  • Germany's BSI and Japan's government said they had confirmed no successful exploitation.

PHP has released fixes for the two flaws nicknamed PHP2Shell, but the patch only protects a server once its owner installs it and restarts PHP. PHP does not update itself, so hosting companies, IT departments and individual site owners must apply the update themselves.

Attackers have been trying hard. Cloudflare chief executive Matthew Prince said his network logged thousands of exploit attempts in the 10 hours before the flaws were announced, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions since. Amazon said its decoy servers recorded an attempt on 17 October, four days before disclosure, and its CISO CJ Moses said the bugs are now being widely exploited.

The PHP Foundation said its 2024 security work found early signs of the out-of-memory bug behind one of the flaws, but the team could not agree on a fix and lacked resources. It called the delay "a structural failure" and said its security team will now decide by majority rather than consensus. Older branches, PHP 8.1 and earlier, no longer receive official releases, and Mallory counted about 884,000 internet-facing hosts running versions with no official fix.

Many sites went offline on Wednesday rather than run unpatched, including Wikimedia services, 32 UK government services and Dutch hospitals, according to TechRadar.

What to watch: Server owners are being urged to check for signs of intrusion since at least 17 October, not just patch, because earlier compromise may go unnoticed.

Read the full story on Decrypt

Live updates on NewsFeeds:MacroDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)

How this was produced: an AI model wrote this summary of Decrypt’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.

Not investment advice. Read the risk disclaimer.

← Back to NewsDesk