Troy Hunt

A brief update on the critical vulnerabilities in PHP:  We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM. Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should: ​1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services ​2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window ​3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching 🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…  🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc… 🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…

We protect over 5 million PHP sites and when we find a major exploitable vulnerability, we always see site cleanings. We have seen exactly zero hacked sites from php2shell. Zero. Across a population of 5 million PHP sites that our product protects. Draw your own conclusions. #php2shell