PHP Flaws Could Let Attackers Take Control of Web Servers

Two severe flaws in PHP could let remote attackers run commands on vulnerable servers, putting crypto platforms and other websites at risk of full system takeover.

The bugs, called php2shell, are remote-code-execution vulnerabilities. A specially constructed web request could trigger them and make a server execute commands. PHP maintainers moved the planned release of emergency fixes to 10 a.m. ET (14:00 UTC) Wednesday after a forum post surfaced the day before.

An attack may be detectable if a PHP process unexpectedly starts bash, Python or curl to retrieve malicious files. The language underlies widely used website platforms such as WordPress and Drupal, and also appears in business sites and control panels.

Administrators should inventory all PHP installations, including software embedded in products, and prioritize internet-facing systems when fixes are available. Systems running unsupported PHP may not receive a patch, leaving administrators to upgrade or isolate them.