GoKawiilPHP2Shell Patching Lags Far Behind Mass Exploitation, Researchers Find
Security researchers report that organizations are patching newly disclosed PHP vulnerabilities, dubbed PHP2Shell, much slower than attackers are exploiting them. Cloudflare's CEO said exploitation attempts rose from thousands to millions within hours of disclosure, while Check Point found 10% of organizations worldwide had already seen exploitation attempts. Ox Security and Flare separately found that over 97% of scanned instances had not advertised patched versions a day after fixes were released, and roughly half may never be patched, according to Cisco Talos.
GoKawiil's interpretation of the reporting above, not reported fact.
The gap between rapid exploitation and slow patching suggests many organizations could remain exposed for an extended period, giving attackers a wide window to compromise systems. Experts cited in the reporting say updating PHP installations is unusually complicated, which may explain the lag, though this interpretation of difficulty is their assessment rather than a stated fact. The findings could pressure the PHP Foundation and hosting providers to simplify patching processes or issue further guidance.
- Exploitation attempts reportedly jumped from thousands to millions within hours of PHP2Shell's disclosure.
- Over 97% of scanned PHP instances had not shown updated versions a day after patches were released, per Ox Security.
- Cisco Talos estimates roughly half of all PHP systems may never receive patches for the vulnerability.
Yubico YubiKey 5C NFC — When server-side vulnerabilities like PHP2Shell are actively exploited, locking down administrative and developer accounts with hardware-backed authentication is a smart compensating control. A YubiKey adds phishing-resistant multi-factor authentication to the admin panels and deployment pipelines that attackers would otherwise try to pivot into. It's a simple, durable way to raise the bar while your team scrambles to patch.
See Yubico YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Nate Nelson, 2026-10-23
Published there as: “Exposed to PHP2Shell? Cyber Experts Weigh in With Advice”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.