I had plans for that second

Two critical unauthenticated remote code execution vulnerabilities were discovered in PHP, affecting all builds since version 5.4. These vulnerabilities, known as 'php2shell', can be triggered by a simple HTTP request, allowing attackers to execute arbitrary code remotely. Given PHP's widespread use in major web platforms such as WordPress, Drupal, Magento, Shopware, and WooCommerce, the potential impact is extensive. Older PHP branches are no longer supported and will not receive patches, which could account for approximately 50% of deployments. Cisco Talos has published Snort intrusion detection rules (IDs 67359 and 67360) to help detect exploitation attempts. The recommended mitigation is immediate upgrade to PHP 8.2 or later, as no patches are available for PHP 8.1 or earlier versions.

Successful exploitation of these vulnerabilities allows unauthenticated remote code execution on affected PHP servers, potentially leading to full system compromise. The widespread use of PHP in popular content management and e-commerce platforms increases the blast radius significantly. Systems running unsupported PHP versions remain vulnerable without available patches, increasing risk exposure.

Cisco Talos customers are protected by Snort signatures 67359 and 67360, which detect exploitation attempts. The vendor strongly advises immediate upgrade to PHP 8.2 or later, as no patches exist for PHP 8.1 or earlier. Organizations should prioritize updating PHP installations to a supported and patched version to mitigate risk. Monitoring for exploitation attempts using available detection rules is recommended until upgrades are completed.