https://reddit.com/r/sysadmin/comments/1xd7683/php2shell_the_useful_question_isnt_are_we_patched/: PHP2Shell: the useful question isn't "are we patched", it's "where is PHP actually running in our environment"
Affected Software
Frequently Asked Questions
Which PHP branches do not have an upstream fixed release?
PHP 5.4 through 7.3 have no upstream fix. PHP 7.4, 8.0, and 8.1 have source backports only, so organizations must build them or wait for their distribution to provide a package.
What operational step is required after updating PHP packages?
Restart PHP-FPM and Apache workers, then verify that running processes use the updated build. Existing workers can continue serving requests with the old runtime after a package update.
What can be done if an immediate patch is not available?
Lowering memory_limit, post_max_size, or max_input_nesting_level may reduce opportunity but does not remove the vulnerability. For branches with source backports, building the backport or obtaining a distribution package is the stated path; older unsupported branches have no upstream fix.
Where should teams look for PHP runtimes outside normal web-team ownership?
Review hosting control panels, appliance management consoles, legacy applications, and forgotten campaign microsites. These may include their own PHP runtime even where the primary web environment is believed not to run PHP.
Is there evidence of exploitation before fixes were released?
AWS MadPot honeypots observed an attempt on 17 October, while fixes shipped on 21 October. The provided reporting documents attempts rather than a confirmed scale of compromise.