Website operators should patch supported PHP branches against the “php2shell” vulnerability, according to a PHP security advisory cited by BlockBeats on Oct. 22. The report listed PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or the corresponding fixes supplied by a distribution.
Patch guidance
Users on PHP 8.1 or earlier were advised to move to a supported branch or ask their distribution or long-term-support provider whether an older-version fix is available. Updating only website code or plugins does not update the server’s PHP runtime.
Additional safeguards
BlockBeats relayed CISA advice to enable multifactor authentication, use separate strong passwords for different accounts and treat urgent password-reset notices with caution. Those steps can reduce account-takeover and phishing risk, but they do not repair the server-side vulnerability.
The report also cited Cloudflare’s warning that WAF and upload restrictions cannot replace a patch. Huntress recommended inventorying PHP on servers and control panels, prioritizing public-facing systems, isolating systems that cannot be patched promptly and preserving logs when suspicious PHP processes appear.