A post-mortem from the PHP Foundation says a small group of maintainers knew about a serious PHP vulnerability for two years before it became public. The issue is now being exploited in attacks known as PHP2Shell, which can enable remote code execution when attackers know the PHP version and build running on a target server.

The flaw stems from PHP’s handling of memory exhaustion. If the engine jumps to its cleanup process while constructing a data structure, incomplete data can remain in memory. A crafted web request can exploit that inconsistent state to run code with the permissions of the PHP process.

The Foundation said maintainers did not initially consider the issue a pressing concern and debated how to address it without breaking compatibility with third-party extensions. It acknowledged management mistakes. The team described in the post-mortem is small: one full-time employee and 14 part-time contractors maintain a programming language used widely across the web.

The vulnerability’s impact is compounded by the number of installations running unsupported software. The report says 73% of PHP installations were on end-of-life versions when the issue was disclosed. PHP’s currently maintained branches range from 8.1 to 8.5, while many older installations depend on operating-system distributions or community repositories for security updates.

The PHP Foundation published patches covering versions 7.4 through 8.1. Other organizations have also made fixes available for older releases, including packages from Debian developer Ondřej Surý, CloudLinux and AlmaLinux. Commercial support providers Ubuntu Pro and Zend have issued packages for versions as old as PHP 5.5. The source says nearly 8% of installations were still using PHP 5.x, first released in 2005.

Web application firewalls and other security tools can help block or detect malicious activity, but updating to a patched version remains the direct fix. Cloudflare and Fastly added PHP2Shell detection to their rulesets, while server security products can monitor for suspicious activity by the PHP binary. Some network appliances and NAS devices also include PHP and may require updates.

The report describes ongoing exploitation, including a campaign that combined the PHP flaw with Fragnesia, also known as Dirty Frag, to gain kernel-level access to 25 servers seemingly linked to the U.S. government. Security firm BitSight reported numerous PHP2Shell intrusion attempts from different sources by October 29. At that time, it had not found a single, universal exploit package, though the report warned that this could change.

Censys initially estimated that about 45.7 million of 119 million PHP installations were vulnerable. Its later count put the number of unpatched services at around 29 million. However, 62% of the PHP servers it monitors do not report their version, and backported fixes may not change version numbers, making the true patch status difficult to determine.

Sources: Tom's Hardware.