SecurityWeek (1 hour ago)
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.
Read the full story on SecurityWeek.
PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.
Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X. Officials in Germany, the Netherlands and Japan say they have not seen one succeed. Some stats on #php2shell.
Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.
Everything you need to know about PHP2Shell in terms of what it is, and what this security flaw means for the average person browsing the web.
Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.
72 active sources
27 Turkish · 45 English
All sources
