The PHP2Shell Security Crisis Explained

Summary

Servers can be taken over without authentication. Up to 70% of websites worldwide are exposed (press reports).

The flaw is in the PHP engine itself, so a well-built website doesn’t help. Public attack code and attack attempts have already been reported.

10/17First attack attempts seen by Amazon’s sensor network — 4 days before the official announcement
10/20Vulnerability details leak online
10/21PHP releases emergency patches (8.5.12 · 8.4.27 · 8.3.36 · 8.2.35). Public exploit code appears; millions of exploit attempts (press reports)
10/22Korean government raises the private-sector cyber crisis alert from ‘Attention’ to ‘Caution’

What is at risk

Remote takeover, no login

A single crafted request runs arbitrary commands on the server. It leads to web shells, customer data leaks, defaced websites and intrusion into internal networks.

Who is affected

PHP 5.4 – 8.5.11

Almost every PHP release since 2012. GNUBoard, YoungCart, WordPress, Rhymix and custom-built sites are all affected.

Why now

Attack code already public

Attack attempts using the public attack code are continuing. Updating alone isn’t enough: the web server (PHP-FPM, Apache) must be restarted for the fix to take effect.

Safe baseline versions 8.5.128.4.278.3.368.2.35 or later + web server restart

PHP 8.1 and older get no official patch. PHP 8.2 support also ends at the end of 2026, so moving to 8.3 or later is recommended. If you don’t restart the web server after updating, the old version keeps running.

If you wait

“Who would target a small company like us?”
Attacks aren’t picked by a person.

Attacks are being attempted in bulk across the entire internet, regardless of target (millions of exploit attempts, press reports). In Korea alone, about 110,000 servers are estimated to run a vulnerable PHP version (AhnLab survey, before the patch release). The government’s emergency notices went mainly to companies that have registered a Chief Information Security Officer (CISO), so small businesses have to look after themselves.

72 hours

Once you learn of a personal data leak, you must notify customers within 72 hours, and if it was caused by hacking, report it to the Personal Information Protection Commission or KISA.

Up to KRW 30 million

Failing to report a leak is subject to an administrative fine.

Up to 3% of revenue

If data leaks because security measures were not fully taken, a penalty surcharge of up to 3% of total revenue may be imposed.

Basis: Korea’s Personal Information Protection Act, Articles 34, 64-2 and 75, and its Enforcement Decree, Articles 39 and 40 (Easy-to-Find Practical Law (easylaw.go.kr), Personal Information Protection Commission)

Done once you patch? No.

The government advises that even updated servers be checked separately for abnormal access logs and installed web shells. A hacker who got in before the patch is not kicked out by the patch.

Is my site affected?

If even one of these applies, you are at risk now.

These sites need action today

Sites built on GNUBoard, YoungCart, WordPress or Rhymix
Websites and online stores built by an agency with no one maintaining them
Running on server hosting, a VPS, the cloud or your own server
Using an old version: PHP 5.x, 7.x or 8.1 and older
Sites that store member, order or payment data
Sites that recently slowed down, show 500 errors or have unknown files

Why web hosting is no guarantee either

PHP 8.1 and older get no official update, so you have to confirm separately how far your host has gone
If the web server isn’t restarted after the update, the old version keeps running
Hacking files (web shells) planted before your host patched stay in place after the patch
Your host manages only the server. Checking your site files and admin accounts is up to you
Attack attempts were observed from 10/17 (Amazon report), so there was an exposure window before the patch

Sources: KISA KrCERT (Boho Nara) · Digital Times (Ministry of Science and ICT announcement) · The Fact · Help Net Security · Vercel

We’ll upgrade your old PHP. Up to 20 pages for KRW 300,000.