On October 23, PHP advised users to temporarily disable its session upload progress feature until the next regular bugfix release. The warning followed an earlier advisory issued on October 21 about a related vulnerability. The latest issue affects applications only when specific session settings are changed while the application is running and the upload progress feature remains enabled. Users who have already disabled the feature do not need to take further action.
The broader security concerns centre on two critical vulnerabilities collectively referred to as PHP2Shell. Aamir Lakhani, global director of threat intelligence and adversarial artificial intelligence research at Fortinet, said, "Two critical PHP vulnerabilities disclosed this week pose an urgent security and business continuity risk for organizations that depend on websites, customer portals, and other web applications."
PHP is a server-side programming language used by widely deployed platforms such as WordPress, Drupal, Joomla and Magento. Organisations could be exposed through commercial applications, hosting providers and embedded software components, even if they do not develop PHP applications themselves.
The potential scale of exposure is significant. Censys identified approximately 36.7 million internet-facing services reporting potentially affected PHP versions in its October 22 snapshot. These figures represent service counts rather than unique servers or organisations and may include installations that have already been patched through vendor updates.
Saeed Abbasi, head of the Threat Research Unit and director of product at Qualys, said the company had identified 167 million PHP package installations across 12,000 organisations, with 73% deployed on internet-facing assets, placing them within reach of remote attackers.
"Applying a patch alone will not be sufficient for systems running unsupported versions, where upgrading is the only viable long-term solution. The key takeaway is that nearly all PHP installations are either vulnerable or running unsupported versions," Abbasi said.
Meanwhile, CloudSEK reported that Shodan had identified 2.2 million internet-facing services displaying PHP information worldwide, with India ranking ninth, accounting for 53,400 services.
According to Akash Karthi, a security researcher at CloudSEK, of the 36,700 Indian services revealing their PHP versions, approximately 36,100 remained unpatched. These included 19,500 services running versions that had reached end of life.
The advisories and exposure estimates highlight the security risks facing organisations that rely on PHP-powered websites and applications. With potentially affected services spread across hosting environments, commercial platforms and embedded software components, identifying vulnerable installations, applying available updates and upgrading unsupported versions remain central to mitigating the risks.
About The Author
Comment List