A global cybersecurity alert has been issued following the discovery of two critical vulnerabilities in PHP, a widely used server-side programming language. These security flaws carry the potential to allow unauthorized hackers to remotely execute code on affected servers, posing a significant threat to millions of internet-facing services worldwide. The issues have prompted urgent warnings from security researchers and industry analysts regarding the risks to web-based platforms, customer portals, and corporate applications.
As part of the immediate response, the PHP project issued an advisory on October 23, urging users to temporarily disable the session upload progress feature until a formal bugfix release is made available. This directive follows an initial advisory released on October 21 regarding a related security vulnerability. Developers have clarified that this specific issue primarily affects applications where the upload progress feature is active and certain session settings are modified during operation. Those who have already disabled this specific feature are not required to undertake further action.
The broader concerns relate to two vulnerabilities, which have been collectively identified in the industry as "PHP2Shell." Aamir Lakhani, the global director of threat intelligence and adversarial artificial intelligence research at Fortinet, highlighted the gravity of the situation. He noted that the disclosure of these vulnerabilities represents an urgent risk to both security and business continuity for organizations that rely on web applications, including various portals and websites that utilize PHP-based frameworks such as WordPress, Drupal, Joomla, and Magento.
The scale of the potential exposure is extensive. Data from the service Censys, based on an October 22 snapshot, identified approximately 36.7 million internet-facing services reporting PHP versions that may be impacted. Similarly, research from Qualys indicated the presence of 167 million PHP package installations across 12,000 organizations, with 73 percent of these assets deployed on internet-facing systems, thereby increasing their accessibility to potential remote attackers. Saeed Abbasi, the head of the Threat Research Unit at Qualys, emphasized that merely applying a patch may prove insufficient for systems running software versions that are no longer supported. For these instances, he stated that an upgrade remains the only viable long-term security solution.
In India, the impact of these vulnerabilities remains a point of focus. According to reports from CloudSEK, Shodan identified approximately 2.2 million internet-facing services displaying PHP information globally, with India ranking ninth on the list with 53,400 such services. Security researcher Akash Karthi noted that of the 36,700 Indian services revealing their PHP versioning, approximately 36,100 remained unpatched. Critically, 19,500 of these installations were running versions that had already reached their end-of-life cycle, further complicating the remediation process for system administrators.
Companies that do not develop their own PHP applications may still face exposure through third-party commercial applications, hosting providers, or embedded software components that utilize the language. Security professionals continue to monitor the landscape, advising organizations to review their infrastructure and implement recommended patches or upgrades as quickly as possible. As the situation develops, IT departments are being urged to prioritize the security of their web-facing assets to mitigate the risk of unauthorized remote exploitation.
Comments