Wiz Research finds PHP2Shell RCE CVEs exploited

Security researchers discovered two critical remote code execution vulnerabilities in the PHP programming language, dubbed PHP2Shell, which were found to have been exploited in the wild before patches were released. Organizations rushed to apply upstream patches, update web application firewalls, or temporarily take their web portals offline to prevent server compromise. The incident highlights the fragile state of foundational web technologies and the risks of legacy code that lacks memory safety. Open article →