PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Critical PHP vulnerabilities dubbed PHP2Shell can enable unauthenticated remote code execution and sensitive memory disclosure across a vast portion of the web, putting customer-facing apps, internal portals, and shared hosting environments at immediate risk. Because the flaws sit in PHP’s core engine, they affect many organizations regardless of CMS hardening, and early exploitation attempts mean IT teams should treat this as an active threat rather than a future patch cycle item. The strategic takeaway for CIOs is that language/runtime patch management, asset inventory, and rapid rollback/compensating controls need to be part of core resilience planning—not just application-level security.