Two high-severity flaws rated 9.2 out of 10, referred to as PHP2Shell, have been disclosed.
PHP announced a patch release for October 21 at 14:00 UTC, with no active attacks reported.
Affected versions and internal components have not yet been disclosed, while CERT-EU advises isolating internet-facing applications until updates are applied.
What we know and who is affected
These issues have received an extremely high severity rating and are collectively called PHP2Shell. So far, the creators have not reported any actual attacks exploiting them, nor have they disclosed which versions are affected, which part of the code is involved, or whether any setting affects the vulnerability.
Official fixes will be released exclusively for the four supported versions, namely 8.2 through 8.5. Versions older than 8.2, such as 8.1, 7, and 5, are now considered obsolete and will not receive any official updates.
The regulation in circulation and the disagreements
A recommendation to change a specific setting for file upload progress in configuration files has been circulating online to prevent the risk. Security companies have disagreed on its effectiveness: some have suggested it as an immediate measure, while others have said there is no confirmed solution beyond an official update.
READ ALSO
Serious PHP security flaw threatens millions of websites worldwide
A PHP development expert clarified that the only way to protect yourself is to install the update, as temporary settings can be easily bypassed. Independent researchers have also questioned whether the specific bug described around file uploads even exists in official versions.
Temporary protection measures
Until official updates are released, experts recommend that organizations and administrators consider isolating their applications from the public internet.
In addition, it is proposed to reduce the amount of stored data, access rights and digital keys, as well as to enable event logging on the computers that manage the websites. For their part, internet service providers and hosting companies have started to add security rules or prepare updated packages.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
