Security· ★★★★· bearish·

PHP Ships PHP2Shell Patches, But Millions of Exploit Attempts Continue

  • —PHP does not auto-update: admins must install the patch and restart PHP manually
  • —Cloudflare saw thousands of exploit attempts before disclosure and millions since
  • —Amazon logged an exploit attempt on October 17, four days before the bugs went public
  • —The PHP Foundation called the fix delay a 'structural failure' driven by limited resources
Why it matters: PHP powers roughly 70% of websites, so unpatched servers remain exposed to remote takeover.
Source: Decrypt