PHP vulnerabilities expose millions of services to remote code execution risk

Two critical PHP vulnerabilities, collectively called PHP2Shell, could let hackers remotely execute code on servers without authentication, triggering a global cybersecurity alert that potentially exposes millions of internet-facing services. PHP advised users on Oct 23 to temporarily disable its session upload progress feature until the next bugfix release, following an earlier Oct 21 advisory. The latest issue affects applications only when specific session settings change while running and the feature remains enabled; users who already disabled it need no further action. PHP powers platforms like WordPress, Drupal, and Joomla. Censys found about 36.7 million internet-facing services with potentially affected versions, while Qualys reported 167 million PHP installations across 12,000 organizations, with 73% on internet-facing assets. CloudSEK noted India had roughly 36,100 unpatched services among those revealing versions.