PHP2Shell Exploitation Started Days Before Patches

PHP2Shell is shaping up to be a high-risk internet-wide PHP event, with exploitation attempts beginning before patches were public and accelerating to millions of scans and attacks within hours of disclosure. For CIOs and technology leaders, the business impact is immediate: exposed web applications, shadow PHP installations, and end-of-life versions create a broad attack surface that can lead to unauthorized code execution, service disruption, and potential lateral movement into core systems. IT organizations should treat this as both a patching emergency and an asset-discovery problem, using it to harden web-facing controls and improve visibility into all PHP-dependent infrastructure.