PHP2Shell Exploitation Reports Put Patched Versions in Focus

The Short Version

The PHP2Shell security story now includes reports of exploitation alongside available fixes. WIRED says Amazon Web Services recorded attempts involving the bugs four days before its report, and describes exploitation as widespread. That brief account does not quantify successful intrusions.

PCWorld identifies PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as releases containing the security patches.

Why It Matters

For someone responsible for a PHP website, the useful comparison is between the installation actually in use and the relevant patched release. A general announcement that fixes exist does not establish whether a particular server has received them.

PCWorld says sites using older PHP versions need the necessary fixes from a vendor maintaining that version. The update path therefore depends on the installation, rather than one version number applying to every website.

The Bigger Picture

PCWorld also describes websites temporarily going offline while PHP upgrades were completed, including government sites in the Netherlands, France and Germany. Maintenance disruption and a successful attack are different explanations for an unavailable website; the outage itself does not settle which occurred.

Likewise, AWS logging an attempt is not evidence that the attempt succeeded against a particular site.

What to Watch

Clear confirmation from a hosting provider or administrator about the installed version would make the release information useful for an individual website. Further incident reporting would help establish the scale of successful attacks. The supplied WIRED account gives no victim count or success rate, so its exploitation report should not become a claim that every PHP site has been compromised.

How easily could you confirm which PHP version your website or hosting provider is running?