NEWS: The PHP project released emergency security updates for two critical vulnerabilities collectively known as PHP2Shell following an early leak of their details.

ABOUT PHP2SHELL

• Meaning: Two critical Remote Code Execution (RCE) vulnerabilities in PHP.
• PHP: Hypertext Preprocessor → open-source, server-side scripting language used for website development.
• Severity: CVSS v4.0 score of 9.2 for each vulnerability.
• Root Cause: Memory-management errors exposing incomplete or freed data.
• Discovery: Researchers used Large Language Models (LLMs) to identify the vulnerabilities.

THREATS

• Unauthorised Access: Attackers may execute code remotely without authentication.
• Data Breach: Potential theft of sensitive data + server takeover.
• Wide Impact: PHP-based websites, content management systems + hosting platforms are at risk.

MITIGATION

• Security Patches: Install official PHP security updates.
• Web Application Firewall (WAF): Provides partial protection but does not eliminate vulnerabilities.
• Monitoring: Check server logs + update vulnerable PHP deployments promptly