The vulnerabilities are each rated CVSS v4.0 9.2 and attack traffic has already been reported. Both flaws allow unauthenticated remote code execution, and leaked PHP worker memory can expose passwords, tokens and API keys. While PHP has released fixes for both flaws, the Qualys Threat Research Unit (TRU) found nearly all PHP installations are either vulnerable or running unsupported versions. Over seven in 10 installations are running end-of-life or end-of support versions, for which a patch will not be available.
From anonymized data of more than 10,000 customers globally, the Qualys TRU team found 167 million PHP package installations with 73% of them on internet-facing assets, putting millions of websites and systems within reach of remote attackers.
Among the 156 million PHP package installations with a known version:
- Only 28% that are vulnerable (44 million) run supported branches, PHP 8.2 to 8.5. A fix is available for these versions.
- 110 million (71%) run end-of-life (EOL) or end-of-support (EOS) versions of PHP, from 5.4 to 8.1. Most of these will never get a vendor patch. As upgrading or patching PHP could have a business impact, mitigation is the recommended solution to reduce risk quickly.
- Only 581,000 (0.37%) were patched in the first 24 hours after disclosure.
The free trial includes products across the Qualys TruRisk Platform, including Qualys VMDR, Enterprise TruRisk Management (ETM), and TruRisk Eliminate, so security teams can move from discovery to a verified fix in one workflow.
Qualys solutions enable organizations to:
- Discover – Detect every vulnerable PHP instance within 60 minutes, including PHP running in containers or bundled inside other applications.
- Prioritize and validate – Prioritize internet-facing servers and legacy PHP versions and validate which servers attackers can actually exploit given an organization’s existing controls.
- Patch supported PHP versions – Patch supported PHP versions, then restart PHP services so the fix takes effect.
- Mitigate unsupported or EOS/ EOL versions – On PHP 8.1 and earlier, apply OS vendor backports where they exist, or isolate those systems and plan to retire them.
- Verify – Rescan to confirm every exposure has been closed.
“PHP2Shell puts a large share of the web at risk, and over 70% of installations will not have a patch,” said Shailesh Athalye, chief product solutions officer of Qualys. “With attackers already moving, security teams need to know right now whether they are exposed and how to fix it immediately. Qualys is making our services available so organizations can find, prioritize and close these exposures before they are exploited.”
