The PHP security team will release fixes for two critical vulnerabilities at 14:00 UTC. Technical details appear to have leaked before the scheduled disclosure time, with Cloudflare detecting early signs of attack. Security agencies warn that widespread exploitation could occur rapidly once the patches are made public.
Current circulating information presents differing views on the severity of the vulnerabilities: the initially published CVE score was 9.2, while Benjamin Harris, CEO of WatchTowr, stated that both remote code execution vulnerabilities have a CVSS score of 10 and may affect PHP 5, 6, 7, and 8. Formal details have not been fully disclosed yet, so the exact scores and scope of impact should be based on subsequent security announcements.
Videos allegedly showing the "PHP2Shell" tool executing code remotely on web servers have already appeared online. Cybersecurity firm Sansec stated that web servers running PHP 5.4 or higher could be affected, and predicted that large-scale attacks might emerge within 15 minutes of the patch release.
Dane Knecht, Head of Technology at Cloudflare, stated that the company is updating firewall rules for PHP sites in response to newly emerging attack vectors, but such measures can only provide temporary mitigation. Website administrators should inventory all PHP installations, schedule maintenance windows aligned with the update release time, back up website and database files in advance, and install the patches as soon as they are released.