PHP2Shell puts organizations in a race to find vulnerable servers before attackers do. The flaws became public before fixes were available, and attackers can now turn security patches into working exploits in under an hour. The biggest concern is older systems that organizations may not even know they’re running: Only PHP 8.2 and newer are receiving patches, while W3Techs data suggests roughly half of PHP websites run older versions.
Commentary from the Detectify Security Research team:
“Many organizations will learn about a forgotten PHP server when an attacker finds it. That’s the risk with this one: the flaws became public before the fix did, so both sides are starting at the same time. Attackers aren’t waiting for a working exploit. They’re building a list of every server on the internet that says it runs PHP, sorted by version, and the moment the fix is out, they will compare the old code with the new one to find the flaw.
“The playbook used to be: patch comes out, attackers reverse-engineer it over a few days, defenders have a window. That window is closing. Recent research has shown AI models turning a security patch into a working exploit in under an hour, for a few thousand dollars in computing costs. PHP2Shell is landing in that world, and some researchers expect mass exploitation within minutes of the release.
“The oldest versions matter most because they won’t be fixed. Only PHP 8.2 and newer are getting patches, and based on W3Techs data, roughly half of all PHP websites are running something older. That’s the real exposure. Those sites haven’t been updated in years, which usually means nobody is watching them either.
“So the question this week is this: do you know where all your PHP is running? If yes, this is an afternoon of updates. If no, the risk is in the systems you’ve forgotten: an old marketing site, a hosting control panel, a device with PHP built in. And speed matters more than ever.
“Our own Cyber Hygiene Index found that nine in ten open critical and high-severity vulnerabilities stay exposed for more than 90 days. Against an exploit that can be built in an hour, that gap is the whole story. Find your forgotten systems before someone else does, and then check nobody got there first.”
I should also mention that Detectify, a Swedish application security company specializing in internet-facing vulnerabilities, found in its Cyber Hygiene Index that nine in ten open critical and high-severity vulnerabilities remain exposed for more than 90 days. You may want to have a look at that.
Related
This entry was posted on October 21, 2026 at 9:20 am and is filed under Commentary with tags Detectify. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
PHP2Shell – Attackers are mapping vulnerable servers before fixes arrive
PHP2Shell puts organizations in a race to find vulnerable servers before attackers do. The flaws became public before fixes were available, and attackers can now turn security patches into working exploits in under an hour. The biggest concern is older systems that organizations may not even know they’re running: Only PHP 8.2 and newer are receiving patches, while W3Techs data suggests roughly half of PHP websites run older versions.
Commentary from the Detectify Security Research team:
“Many organizations will learn about a forgotten PHP server when an attacker finds it. That’s the risk with this one: the flaws became public before the fix did, so both sides are starting at the same time. Attackers aren’t waiting for a working exploit. They’re building a list of every server on the internet that says it runs PHP, sorted by version, and the moment the fix is out, they will compare the old code with the new one to find the flaw.
“The playbook used to be: patch comes out, attackers reverse-engineer it over a few days, defenders have a window. That window is closing. Recent research has shown AI models turning a security patch into a working exploit in under an hour, for a few thousand dollars in computing costs. PHP2Shell is landing in that world, and some researchers expect mass exploitation within minutes of the release.
“The oldest versions matter most because they won’t be fixed. Only PHP 8.2 and newer are getting patches, and based on W3Techs data, roughly half of all PHP websites are running something older. That’s the real exposure. Those sites haven’t been updated in years, which usually means nobody is watching them either.
“So the question this week is this: do you know where all your PHP is running? If yes, this is an afternoon of updates. If no, the risk is in the systems you’ve forgotten: an old marketing site, a hosting control panel, a device with PHP built in. And speed matters more than ever.
“Our own Cyber Hygiene Index found that nine in ten open critical and high-severity vulnerabilities stay exposed for more than 90 days. Against an exploit that can be built in an hour, that gap is the whole story. Find your forgotten systems before someone else does, and then check nobody got there first.”
I should also mention that Detectify, a Swedish application security company specializing in internet-facing vulnerabilities, found in its Cyber Hygiene Index that nine in ten open critical and high-severity vulnerabilities remain exposed for more than 90 days. You may want to have a look at that.
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 9:20 am and is filed under Commentary with tags Detectify. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.