PHP ships emergency patches for critical PHP2Shell flaws
This follows a Tuesday warning from PHP developers urging administrators to prepare to install these security updates as soon as they're released.
"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," they said. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."
PHP core developer Gina Peter Banyard warned that no PHP2Shell mitigations would fully block potential attacks and that applying the official security patches is the only permanent defense.
Before the patches were released, Cloudflare CTO Dane Knecht confirmed that the company (which had already deployed a set of WAF rules designed to block known PHP2Shell exploitation methods) was already observing early attacks targeting the two vulnerabilities. However, Knecht also stressed that these protections were temporary and urged all admins to install the PHP security updates as soon as they become available.
The UK National Cyber Security Centre (NCSC) has also warned UK organizations to immediately update systems using PHP or take them offline until they can be patched.
Related Articles
