What happened
Organisations running PHP-based applications experienced active exploitation of PHP2Shell before official patches were available. Initial attempts were detected on October 17, with widespread activity occurring shortly after patches were released. The exploitation involved recognised vulnerabilities that were targeted prior to the disclosure and remediation updates being made accessible by vendors. The activity was confirmed to be ongoing in the wild, indicating that attackers had already gained access or were attempting to gain unauthorised control of affected systems.
Who is affected
The exploitation primarily impacts organisations operating PHP servers or hosting environments where PHP2Shell could be executed. Since the exploitation was detected prior to the release of vendor patches, any deployment running vulnerable PHP configurations during that period remains at risk. The lack of specific CVE identifiers suggests that the vulnerabilities exploited are not yet formally assigned or documented in public databases at the time of this advisory.
Recommended actions
- Immediately review PHP deployment configurations to identify potential vectors for PHP2Shell exploitation.
- Implement network security controls to restrict access to PHP-based services, especially from untrusted sources.
- Monitor network traffic and system logs for unusual activity indicative of exploitation attempts, such as unexpected outbound connections or command execution patterns.
- Plan for rapid deployment of patches or mitigations once vendor updates become available, prioritising systems showing suspicious activity or known compromises.
