PHP2Shell will persist in enterprise environments for years
Summary
Two critical vulnerabilities in PHP, dubbed PHP2Shell, have been announced and are actively being exploited, with CISA adding them to its Known Exploited Vulnerabilities catalog. These flaws pose a long-term threat to enterprise environments as they affect numerous third-party products like NAS devices, firewalls, and IoT devices, many of which use unpatchable or unsupported PHP runtimes.
IFF Assessment
The discovery and active exploitation of critical vulnerabilities in a widely used technology like PHP, which affects numerous embedded devices and systems, represents a significant threat to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 29, 2026. Known ransomware use: Unknown.
Defender Context
Defenders must prioritize identifying and patching all instances of PHP that are vulnerable to PHP2Shell, especially those within embedded devices and OT environments where patching is often challenging. The ongoing exploitation and potential for widespread impact, similar to Log4Shell, necessitates vigilant monitoring and proactive defense strategies.