UAE firms patch PHP flaw as 4,691 local servers face exposure risk

UAE companies and hosting providers are deploying patched PHP packages to address the critical PHP2Shell vulnerabilities, with 4,691 internet-facing hosts in the country potentially exposed, representing 79.5 percent of its total versioned hosts. The flaws, discovered with AI assistance and disclosed this week, allow unauthenticated remote code execution and memory leaks, with exploitation attempts seen within hours. Tenable Research classified them as a "Vulnerability of Concern," and the US National Security Agency urged organisations to take websites offline if they cannot immediately fix the issues. Patching timelines vary by system, with Linux distributions receiving updates within days while end-of-life PHP versions may never be patched. Experts recommend identifying affected installations, applying updates, and investigating unusual activity, noting the vulnerabilities had sat in code running roughly 70 percent of websites for over a decade.