PHP Vulnerability Response: Website Operators Must Immediately Update Versions, Regular Users Should Strengthen Account Security and Phishing Protection

BlockBeats news, October 22: According to the official PHP security advisory, regarding the "php2shell" vulnerability, website operators should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 according to their branch, or install the corresponding fix packages provided by their distribution. Users of PHP 8.1 and earlier versions should upgrade to a supported branch, or contact their distribution and long-term support vendors to confirm patches for older versions.

Ordinary users can refer to CISA's general security recommendations: first, enable two-factor authentication on important accounts such as email and financial accounts; second, set unique strong passwords for different accounts to avoid password reuse; third, be wary of phishing emails impersonating "urgent password reset notifications"—when a password change is needed, open the official website or official app yourself, and avoid clicking suspicious links. The above measures help reduce the risk of account theft and phishing, but cannot fix server-side PHP vulnerabilities.

Cloudflare reminds that the vulnerability lies in the server's PHP runtime environment, and updating only website code or plugins cannot fix it. Users of managed services should contact their service provider to confirm that the underlying PHP has been updated. Cloudflare announced that it has added full HTTP transaction inspection and response rules to its Web Application Firewall (WAF), available to all customers including those on the free plan. WAF protection should remain enabled during remediation, but measures such as WAF and upload restrictions cannot replace patches.

Cybersecurity company Huntress recommends that enterprises conduct a comprehensive inventory of PHP environments across servers, control panels, and third-party software, prioritizing public-facing systems; for versions that cannot be patched in time and are taken offline for maintenance, consider temporarily isolating public network access. At the same time, monitor for abnormal behavior such as PHP processes launching command-line tools, interpreters, or download utilities; upon discovering suspicious activity, isolate the server and preserve website and PHP logs.