
PHP Ships PHP2Shell Patches, But Millions of Exploit Attempts Continue
- —PHP does not auto-update: admins must install the patch and restart PHP manually
- —Cloudflare saw thousands of exploit attempts before disclosure and millions since
- —Amazon logged an exploit attempt on October 17, four days before the bugs went public
- —The PHP Foundation called the fix delay a 'structural failure' driven by limited resources
Why it matters: PHP powers roughly 70% of websites, so unpatched servers remain exposed to remote takeover.
Source: Decrypt