PHP2Shell Flaws Prompt Website Shutdowns Across Multiple Countries

PHP2Shell security flaws have pushed government agencies and major online services in several countries to take websites offline while operators patch bugs that can let attackers run code on servers.

The two PHP flaws score 9.2 out of 10 under CVSS v4 and allow remote code execution without a login. PHP fixes are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The U.S. Cybersecurity and Infrastructure Security Agency urged organizations that cannot patch immediately, including those running PHP versions older than 8.1, to take affected systems offline.

Node.js also issued security updates for a high-severity flaw involving Brotli. Fixed releases are 26.12.1, 24.22.1 and 22.23.4.

The flaws affect server software, not visitors’ phones or computers, so users do not need a special device update. Avoid email links promising urgent updates or password resets, and close pages that ask you to download a browser update or paste a command. If a familiar service is unavailable, check its official notice instead of searching for an alternate address.

PHP underlies sites built with platforms such as WordPress and Drupal, so updating a site’s content-management software alone may not patch the server.