As cited
Copy frozen at (site build).
vulnerabilities
I had plans for that second
This Threat Source newsletter focuses on two unauthenticated remote code execution (RCE) flaws in PHP, dubbed 'php2shell', triggered by simple HTTP requests and affecting every build since version 5.4. The vulnerability poses an enormous blast radius given PHP's use in WordPress, Drupal, Magento, Shopware, WooCommerce, and other widely deployed platforms, with older end of life (EOL) branches receiving no patches. Cisco Talos recommends immediate updates to PHP 8.2 or later and provides Snort signatures 67359 and 67360 for detection and prevention.
Why it matters: Organizations running PHP 8.1 or older must patch immediately; unauthenticated remote code execution is trivial to exploit and affects an estimated 50% of PHP deployments that will not receive security updates.
- Source published
- First seen by Cybersecurity Tracker