PHP announced on Oct 23 that two critical vulnerabilities—collectively dubbed PHP2Shell—could let attackers execute code on 36.7 million internet‑facing services worldwide.
The flaws surface only when the session upload progress feature is enabled and specific session settings are altered, a scenario that plagues WordPress, Drupal, Joomla, and Magento sites.
Fortinet’s Aamir Lakhani warned that the vulnerabilities present an urgent security risk for any organization that relies on web applications.
Quantitative data from Censys, Qualys, and CloudSEK shows that 167 million PHP packages across 12,000 organisations are exposed, with 73% running internet‑facing assets and 19,500 running end‑of‑life versions.
Until the next bugfix release, PHP recommends disabling the session upload progress feature as a temporary mitigation; those who have already turned it off need not act further.
The PHP core team will ship a patch in the upcoming update, and security teams should apply it or upgrade to a supported version before the deadline.