What happened

Security firm Wiz published an analysis of internet-wide exploitation attempts and organizational patching behavior following the PHP2Shell vulnerability chain in PHP. The post reached 165 points on Hacker News.

Why it matters

PHP runs on a large share of web servers, meaning the flaws are being probed across a wide surface. The US had previously said critical PHP flaws were being actively exploited.

The patching picture

  • Attack attempts began appearing quickly after the first disclosures in the chain.
  • PHP had said no emergency patch would be released for the third PHP2Shell flaw, complicating patching strategies.
  • Wiz's compilation also covers trends in how quickly organizations apply fixes.

What it means for readers

Teams running PHP-based systems should review their patch status and exposed servers. Checking logs is recommended to determine whether exploitation has occurred.