PHP2Shell
12
MENTIONS
9
EPISODES
9
PODCASTS
Search complete. 12 mentions across 9 episodes found for "PHP2Shell".
Oct 27, 2026
Dave BittnerHOST
CISA will review its existing capabilities within 60 days, deliver an implementation plan within 180 days, and report on its progress within a year.
Dave BittnerHOST
CISA has added two critical PHP vulnerabilities, collectively known as PHP2Shell, to its catalog of actively exploited flaws.
Dave BittnerHOST
The bugs could allow unauthenticated attackers to execute code remotely on vulnerable systems.
Dave BittnerHOST
Researchers observed widespread exploitation attempts before patches were released October 21st.
Dave SobelHOST
The right way to handle a flaw like this, he argues, is to hand fixes privately to trusted organizations first and go public once core services are protected.
Dave SobelHOST
PHP2Shell broke that because someone inside the process leaked it.
Dave SobelHOST
His answer is a trained, trusted patch liaison.
Dave SobelHOST
He says the quality of that person decides where an organization sits in line for early fixes.
Jared ReimerHOST
On October 23rd, Bleeping Computer reported another PHP remote code execution vulnerability, CVE-2026-115560.
Jared ReimerHOST
This issue is separate from the two PHP2Shell vulnerabilities.
Jared ReimerHOST
According to the PHP security team, exploitation requires an unusual combination of application behavior and configuration settings.
Jared ReimerHOST
The affected application must change its session serialization configuration at runtime under specific conditions while session upload progress remains enabled.
23 MINS LATER
Sundari ParekhSOUNDBITE_SPEAKER
Great.
Sundari ParekhSOUNDBITE_SPEAKER
I think we have a pretty good session ahead of us, so let's get started and we can start the discussion.
DavidSOUNDBITE_SPEAKER
Okay, so I'm going to talk about PHP2Shells, which is a couple of vulnerabilities that surfaced on October 20.
DavidSOUNDBITE_SPEAKER
First off, it is about PHP.
speaker_0HOST
What changed was the AI's ability to trace complex chains of interactions through millions of lines of code that no human could hold in their head simultaneously.
speaker_0HOST
They named the vulnerabilities collectively PHP2Shell, a deliberate reference to Log4Shell, the devastating vulnerability found in a widely used Java library in 2021 that caused years of cleanup across the industry.
speaker_0HOST
The plan was to disclose PHP2 Shell responsibly on October 22nd, giving server administrators time to prepare.
speaker_0HOST
That plan fell apart.
Chloe TonisHOST
According to Amazon's Threat Intelligence Division, there were some exploitation attempts that started Saturday, October 17th before the patches were released and even before this vulnerability was announced.
Chloe TonisHOST
Many POC exploitations were disclosed by various attacking groups, and it is assumed that the PHP2Shell vulnerabilities are being more broadly exploited in the wild, though it's unclear how many attacks are actually going on and how many are successful.
Chloe TonisHOST
If you own a website and it's not managed by some third party, You should upgrade your version of PHP, and if it is managed by a third party, they should either upgrade it for you or release a patch to you that you need to apply.
Chloe TonisHOST
Remote code execution is kind of the worst case scenario, as it can allow attacker access to run code on your website that you don't authorize.
Jack SmithHOST
As the news spread, the attacks picked up.
Jack SmithHOST
At the time of this recording, I have not seen any public report of a confirmed breach caused by PHP2Shell or whatever this vulnerability will be called in the future.
Jack SmithHOST
That's good news, but it does not prove nobody got in.
Jack SmithHOST
It may simply mean nobody has found out yet that somebody got in.
Mike BacaHOST
You never see it, the same way you never see the plumbing behind a faucet.
Mike BacaHOST
On Tuesday, the PHP team released emergency fixes for two critical flaws, which security researchers nicknamed PHP2Shell.
Mike BacaHOST
Both are rated 9.2 out of 10.
Mike BacaHOST
In plain terms, an attacker with no account on a site could send a specially built request and run their own code on the server or read the server's working memory, which can expose other people's passwords, login tokens, and keys from requests happening at the same time.
Jon WellmanGUEST
I do.
Jon WellmanGUEST
Yeah, look, even last week, obviously, we've been talking about this major PHP one called PHP2Shell.
Jon WellmanGUEST
It's been nicknamed.
Jon WellmanGUEST
There were other major, major issues that happened just last week, right? We had similar issues happening in Node.
FabHOST
Welcome to the podcast.
FabHOST
Today, we are talking about PHP2Shell, which is this number of exploits, vulnerability in PHP, which runs a lot of websites, as a lot of people learned all of a sudden.
FabHOST
People who didn't know what PHP was before, I'm guessing, were suddenly made aware that it runs about, I don't know, 70% of the internet.
FabHOST
And if you're a nerd like me and you've been on the web and programming on the web for decades, you of course know what PHP is.
35 MINS LATER
FabHOST
Other places might exist in not default activated or third-party extensions.
FabHOST
So basically, this is what he's describing here is the thing.
FabHOST
This has all the same elements as PHP2Shell, which uses different details in its implementation, but it's the same kind of...
FabHOST
So you have a vulnerability in PHP where PHP basically fucks up with the memory.