Forty-eight hours after the PHP Foundation released emergency patches, global internet telemetry cited on October 23, 2026 by Shattered.io shows that roughly 1.5 million internet-exposed PHP hosts remain unpatched against PHP2Shell.
Why Forgotten Appliances and Legacy VPS Instances Lag Behind
While major managed cloud platforms patched their fleets within hours, hundreds of thousands of self-managed virtual private servers, legacy PHP 7.x/8.0 installations, and embedded network admin panels remain directly reachable on ports 80 and 443.
What Perimeter Telemetry Providers Are Seeing Today
- Millions of Automated Probes: Cloudflare and Palo Alto Networks Unit 42 observed mass scanning targeting multipart POST and
session.upload_progresspaths. - Oversized Form Field Payloads: Attackers transmit 3.5MB+ array field keys combined with null-byte binary strings to trigger OOM cleanup corruption.
- Silent HTTP 200 Exploits: Refined exploits execute shell commands and return a normal HTTP 200 response without crashing the Apache worker.
The most dangerous servers during the PHP2Shell rollout are forgotten staging subdomains and abandoned microservices still running PHP 8.1 or older.
How Hosting Providers Can Identify Shadow PHP Assets
Infrastructure teams should run external attack surface scans alongside credentialed package checks to locate standalone containers and self-compiled PHP binaries that bypass OS package managers.
Isolating End-of-Life Runtimes
Servers running unsupported PHP 5.4–7.3 branches without vendor LTS backports should be placed behind strict zero-trust access gates immediately. Full primary documentation is available via Shattered.io October 23 PHP Exposure Report.
Comments (0)
Leave a Comment