PHP’s Latest Critical Vulnerabilities: 5 Expert Analyses

PHP disclosed 2 critical vulnerabilities known as PHP2Shell on 21 October. They can let someone send malicious web requests to run code with a PHP worker’s privileges or read sensitive data from its memory. The bugs are in PHP itself, so an application can be vulnerable even when its own code is secure.

Both flaws involve PHP mishandling memory during requests. One allows cleanup to act on data left partly initialized after a memory allocation fails. The other lets a later request use state from memory PHP has already freed. In a demonstrated Apache mod_php attack, exploitation happens before application code starts, ahead of the application’s login checks.

Could Your Application Be Affected?

PHP’s maintainers identify all PHP installations serving web requests as potentially at risk, including PHP-FPM, Apache mod_php, FrankenPHP and LiteSpeed. The exact attack depends on the runtime and, in some cases, application behavior. A confirmed PHP-FPM session attack, for example, requires application-created state to survive a fatal error and a later upload request to reach the same worker.

Wiz demonstrated attacks against WordPress, Drupal and Joomla deployments. Those tests show the bugs can affect widely used applications, but give no count of compromised websites. Separately, watchTowr reports observing exploitation in its honeypot network from 21 October.

What Should You Do Now?

Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install your package supplier’s corresponding backported fix. Updating the application alone leaves the vulnerable PHP runtime unchanged. PHP also supplied exceptional minimal source patches for 7.4, 8.0 and 8.1, although those branches remain outside regular upstream support.

How that update reaches your application depends on its hosting. A self-built container needs rebuilding with patched PHP and redeploying. Some managed runtimes update automatically. Google Cloud’s service-by-service instructions show where the application owner still needs to act.

PHP documents temporary configuration measures for teams unable to update immediately. Each covers particular attacks, while a runtime update supplies the complete fix. The maintainers’ notice gives the conditions. If you suspect a server was compromised before patching, investigating that activity is a separate task.

The expert analyses below explain the attacks, deployment choices, and limits of early workaround advice. They also examine the researchers’ claim that AI helped turn difficult memory bugs into working exploits.