Urgent PHP flaws expose websites to remote attacks

Cyber security specialists urged organisations to patch critical PHP vulnerabilities or take exposed services offline. The warnings followed disclosure of flaws in the widely used PHP runtime that underpins websites and online services.

According to security researchers, the vulnerabilities affect software beneath platforms including WordPress, WooCommerce, Magento and Drupal. Analysts said the issue extends beyond websites to shared hosting platforms, control panels and commercial software that rely on PHP on the server side.

Security experts warned the flaws could allow remote code execution on vulnerable servers, raising the risk of data theft, service disruption and follow-on attacks on connected systems.

Several commentators also highlighted the speed at which exploit methods are emerging, saying attackers gained an advantage after information about the vulnerabilities leaked early.

"One of the most important lessons from PHP2Shell is that AI is changing what we consider exploitable. Some of these vulnerabilities existed for more than a decade, and they are particularly concerning because they sit inside the PHP runtime, beneath applications like WordPress, WooCommerce, Magento, Drupal and other widely used web platforms. What changed wasn't the underlying code, but the ability to find those weaknesses and turn them into working exploits. The potential impact is enormous. PHP powers roughly 70% of websites where the server-side programming language is known. This puts a significant portion of the internet's business and commercial infrastructure at potential risk and demands immediate attention. While that doesn't mean all these websites are vulnerable, it shows how widely used this technology is and why organisations need to assess their exposure quickly.

"AI is making sophisticated security research more accessible, which is great news for defenders, but we should assume attackers will benefit from those same capabilities. We need to stop thinking about vulnerability management as simply identifying a flaw, assigning a severity score and waiting for a patch. The real question is how quickly we can identify exposure, understand the risk and prevent a single compromised system from becoming a much larger incident.

"And while everyone is focused on PHP2Shell, it would be a mistake to overlook another alarming security failure: the recent certificate authority incident in which one of the private keys was literally the number 4. We're talking about infrastructure responsible for establishing trust across the internet. If an attacker obtains or can reproduce a certificate authority's private key, they may be able to issue fraudulent certificates, impersonate trusted websites or services, and intercept encrypted traffic in certain circumstances. Even when exploitation is limited, this raises serious questions about which systems and connections can still be trusted.

"As a next step, security leaders need to identify every dependency on the affected certificate authority, inventory certificates and trust stores, confirm whether any issued certificates are used for critical services, and prepare to revoke and replace them as needed. We need to continuously verify the systems and services we trust and make sure our defences can withstand a failure of that trust." said Ismael Valenzuela, Vice President, Labs, Threat Research and Intelligence, Arctic Wolf.

Patch Priority

Check Point said patches are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions remain vulnerable unless maintainers backport fixes.

Updating WordPress or plugins alone will not address the issue if the PHP runtime on the server remains unpatched, it said. Website owners should verify patching directly with administrators or hosting providers, prioritise internet-facing servers, restart affected services and confirm they are running patched versions.

"The danger lies in the fact that the vulnerabilities are directly in PHP, which is used by a vast number of websites and online stores running WordPress, Drupal, Joomla or Magento, as well as shared hosting platforms, cPanel and Plesk control panels, and a wide range of commercial software. The vulnerabilities could allow attackers to remotely execute their own code on a vulnerable server, even without logging in. This could result in data theft, attacks on other systems or service outages.

"The situation was further complicated by a premature leak of information about the vulnerabilities, which gave attackers a head start. Patches are now available, and installing them should be a top priority. However, simply updating WordPress or its plugins is not enough; PHP must be updated directly on the server. Patches have already been released in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions 8.1 and older remain vulnerable unless the patch is backported.

"Website owners should contact their administrator or hosting provider as soon as possible to verify that the patch has been applied. Priority should be given to servers accessible from the internet. After updating, it is important to restart the relevant services and verify that they are running the patched version. Operators using external hosting should confirm with their provider that the patch has been applied. If a vulnerable service cannot be secured quickly, it is advisable to restrict its accessibility or, if necessary, temporarily take it offline.

"At the same time, organisations should check whether an attack has already occurred. Screenshots of the PHP2Shell tool, which targets these vulnerabilities, have already begun to surface. Installing the patch alone will not remove any damage or malicious code attackers may have left on the server. Be vigilant for unusual web service outages, new PHP files, unusual requests, suspicious command execution or server connections to unknown addresses.

"Security systems that block dangerous requests and detect suspicious server behaviour can also reduce risk. It is necessary to continuously update security measures and enable attack blocking. Limiting communication between servers and the rest of the corporate network can mitigate the consequences of a potential breach. These measures help buy time, but they are no substitute for updating PHP itself," said Jiří Kohout, Cyber Risk & Security Strategist - CEE, Check Point Software.

Asset Checks

Filigran said the immediate challenge for many organisations is identifying where PHP is embedded. Businesses should inventory exposed systems, ask vendors about bundled PHP, isolate systems that cannot be patched quickly and check for signs of compromise.

"The hard part is not installing the patch, it is knowing where PHP runs: beneath content management systems, hosting platforms, appliances and third-party products that never advertise it. That is why governments are taking sites offline rather than waiting. The speed cuts both ways. AI found flaws that sat unnoticed for more than a decade, and the same tools let attackers build working exploits in hours, with early attacks already reported.

"Security leaders should do three things today. Inventory every exposed system and ask each vendor whether their product bundles PHP. Patch or isolate what you cannot patch, starting with anything reachable from the internet. Then assume someone got in first: hunt for web shells, unexpected files and new outbound connections. A fix only counts once you have proved it is applied everywhere an attacker can reach," said Samuel Hassine, Chief Executive Officer and Co-Founder, Filigran.