https://reddit.com/r/cybersecurity/comments/1xfywmh/php2shell_security_flaws_now_sucessfully/: PHP2Shell security flaws now sucessfully exploited in the wild
Affected Software
Frequently Asked Questions
What systems appear to be at realistic risk?
The reported successful exploitation targeted an Apache installation running PHP 8.4.26. Administrators running PHP-backed web applications or onion services should treat vulnerable deployments as exposed.
What does successful exploitation allow an attacker to do?
The honeypot evidence showed memory disclosure followed by remote command execution. An attacker able to exploit a vulnerable installation may therefore be able to run commands on the affected server.
Is there evidence that exploitation is more than scanning activity?
Yes. Researchers reported honeypot evidence of successful exploitation, and an independent researcher described the evidence as particularly convincing. The reported attack sequence included memory disclosure and remote command execution.
What should administrators do besides applying the PHP updates?
Patch using the PHP security updates issued October 21 and restart affected services after patching. Because successful exploitation has been observed, also check potentially exposed systems for signs of compromise.