Wichtige Informationen
The PHP security team has announced an upcoming patch for two critical security vulnerabilities, each carrying a 9.2 severity rating on the CVE scale. These flaws, which reportedly affect all web servers running PHP 5.4 or later, were leaked ahead of their scheduled disclosure.
Evidence of the exploit, including a tool named PHP2Shell, has surfaced online, demonstrating the ability to execute remote code on affected servers. Cybersecurity firm WatchTowr confirmed the reality of these vulnerabilities, noting they impact PHP versions 5, 6, 7, and 8.
Experts from Sansec anticipate that mass attacks will commence within 15 minutes of the official patch release. Cloudflare CTO Dane Knecht confirmed that the company is actively updating firewall rules as a temporary stopgap, while urging administrators to apply the official update immediately upon its 2pm UTC release.
Web administrators are advised to prepare for the update by auditing their PHP installations, scheduling maintenance windows, and performing comprehensive backups of site and database files. The situation remains tense as security professionals monitor early attack vectors emerging before the official fix is deployed.
