https://reddit.com/r/cybersecurity/comments/1xcfno5/php2shell_patching_priorities_exposure_checks_and/: PHP2Shell: patching priorities, exposure checks, and the limits of virtual patching
Affected Software
Frequently Asked Questions
Why is checking `php -v` on a server not enough to assess exposure?
It may report only the CLI binary, not the PHP runtime serving web requests. Web workers, containers, and deployment images can run different PHP builds.
Which PHP deployments should be included in an exposure inventory?
Inventory every web-facing PHP runtime, including replicas and rollback images. Confirm the runtime used by each application rather than relying on a host-level CLI check.
How should teams determine whether their installed PHP packages contain a fix?
Check vendor advisories for patched packages. Distribution packages may include backported fixes, so a version check alone may not establish whether the deployed package is fixed.
What should be done after updating an affected deployment?
Replace workers that are still running old code. Also review direct origin access and other request paths that could bypass inspection controls.
Can IPS or WAF protections replace patching?
The data describes emergency IPS protections and proactive WAF blocking, but their effectiveness depends on the applied policy, exceptions, and visibility. They should be treated as enforcement-dependent controls while affected deployments are updated.