PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP has issued emergency patches to address two critical vulnerabilities that allow remote code execution on a web server without requiring an account. These flaws, referred to as PHP2Shell, are located in the PHP runtime and can expose a site to attack regardless of its own application. The updates are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. According to the PHP team, updating to these versions is the only way to fully protect a server from these vulnerabilities. The release of these patches comes as exploit attempts have begun to emerge, highlighting the urgency of the situation.