PHP ships emergency patches for critical PHP2Shell flaws
Summary
The PHP security team has released emergency patches for two critical remote code execution vulnerabilities, collectively known as PHP2Shell. These vulnerabilities could allow attackers to execute arbitrary code on affected PHP installations.
IFF Assessment
These critical vulnerabilities allow for remote code execution, posing a significant threat to systems running vulnerable PHP versions.
Severity
The CVSS score is estimated at 9.8 (Critical) due to the critical RCE nature of the vulnerability, likely exploitable remotely with high impact on confidentiality, integrity, and availability, and with low complexity.
Defender Context
Defenders must prioritize patching affected PHP installations immediately to mitigate the risk of exploitation. Systems running unpatched PHP versions are vulnerable to arbitrary code execution, which could lead to full system compromise. Monitoring for any suspicious activity related to PHP processes is also recommended.