Php2shell

Cloudflare announced it has deployed protections in its web application firewall against the php2shell vulnerability, which can let attackers turn PHP-based web applications into remote code execution channels. The move aims to shield customers from exploits targeting PHP servers, and security observers are sharing the announcement as admins assess whether their own sites are exposed.

Security researchers at Wiz report that an AI-assisted review uncovered a critical remote code execution vulnerability in PHP, dubbed PHP2Shell. The disclosure highlights how AI tools can help discover serious bugs in widely deployed software, and the story is drawing significant attention on developer and security forums, with discussion about PHP's attack surface and the role of AI in vulnerability research.

Amazon's threat intelligence team, through its MadPot honeypot system, detected exploitation of the PHP2Shell vulnerability on October 17, before details were publicly disclosed. The finding means attackers were actively probing the flaw in the wild before security researchers or vendors announced it. The company has published a security blog detailing the timeline and its observations of the exploitation activity.

A security writeup rounds up three pressing items for defenders: the PHP2Shell attack technique, a vulnerability in the LiteLLM proxy, and a GitLab flaw, with guidance on identifying whether your systems run affected components and what needs patching. The recurring theme is knowing your exposure before attackers do.

Cloud security firm Wiz has published an analysis of ongoing PHP2Shell exploitation attempts, tracking which attack techniques are being observed in the wild and how organizations are patching and hardening their systems in response. The report outlines exploitation trends seen so far and the remediation measures IT teams are adopting to close the exposed attack paths.