Php2shell

Security researchers at Wiz report the discovery of a critical remote code execution vulnerability in PHP, found with the help of AI-assisted analysis. The vulnerability chain, dubbed PHP2Shell, is described in a new technical writeup and could allow attackers to run arbitrary code on servers running PHP, which powers a large share of the web.

Cloudflare has rolled out protections in its web application firewall against the php2shell vulnerability, which can allow attackers to turn PHP-based applications into remote command execution footholds. The company published details of the mitigation work on its blog, and the news is drawing attention among developers and security professionals weighing how exposed their PHP deployments are.

Amazon's threat intelligence team, through its honeytrap network MDPOT, detected active exploitation of the PHP2Shell vulnerability on October 17, before the flaw was publicly disclosed. The company published details of the observed attacks in its security blog, noting that attackers were able to compromise servers running vulnerable PHP setups ahead of official advisories.

Cloudflare's chief executive says AI systems are now combing through vast amounts of code, and expects numerous further serious security vulnerabilities to surface, similar to the recently disclosed php2shell flaw. According to the company, years of newly discovered, severe bugs in widely used software should be anticipated as automated analysis accelerates.

UK penetration tester Jaydip Modhwadia, known online as 'killa', has claimed a $2,000 Bitcoin prize in the PHP2Shell capture-the-flag contest. He solved the challenge, designed to test the real-world exploitability of PHP2Shell, in around three hours. Security watchers are highlighting the result as evidence of the technique's practical risk.

A security challenge dubbed PHP2Shell offered a Bitcoin reward to anyone who could break into an unpatched server running PHP. A hacker successfully exploited the server and claimed the bounty. The challenge was designed to test claims that AI tools now make it easy to exploit known vulnerabilities, and the successful breach has reignited debate over how AI is changing offensive security.

A member of Sophos' leadership reports that the company's internal security operations team handled seven separate incidents in a single week, including abuse of a Sophos product via a trial account, the ConnectWise Cloud Backup compromise, the PHP2Shell technique, weak sub-certificate authorities at eMudhra, and a second supply-chain attack. The rapid succession of cases highlights how busy security teams have become amid a wave of recent supply-chain and infrastructure compromises.

A UK penetration tester using the handle 'killa' has claimed a $2,000 Bitcoin prize in the PHP2Shell capture-the-flag competition. The contest challenges participants to exploit PHP applications to gain shell access, drawing interest from security researchers. News of the win is circulating among cybersecurity and cryptocurrency communities.

Security researcher James Pavur ran a "Steal My Bitcoin" challenge offering a $2,000 prize, which was won when a pentester demonstrated a PHP2Shell vulnerability to compromise the target. The stunt showcased how a PHP flaw can be escalated into full remote code execution, drawing attention from security enthusiasts testing their exploitation skills.

Security practitioners are warning that the PHP2Shell vulnerability is being actively exploited and that not all environments can be patched quickly. A workaround is circulating that uses an Nginx rule to block the PHP_SESSION_UPLOAD_PROGRESS payload at the edge, returning a connection drop (444) before it reaches vulnerable containers. Admins running containerised PHP who cannot patch every instance tonight are being urged to apply the filter as an interim measure.