PHP2Shell: CISA confirms active exploitation of critical PHP flaws patched Oct 21; federal agencies get three days to patch

Linha do tempo

1. techcrunch.com ↗ · pub. 27/10/2026 11:40 · coletado 27/10 13:00

   CISA confirms active exploitation of critical PHP2Shell PHP flaws; federal agencies ordered to patch within three days

   ler a análise desta fonte ocultar

   CISA has confirmed in-the-wild exploitation of two critical remote code execution vulnerabilities in PHP, collectively called PHP2Shell, and ordered civilian federal agencies to remediate within three days. The flaws allow unauthenticated remote compromise over the internet. Patches were released less than a week before the warning. PHP reportedly runs on about 70% of web-facing servers, and some governments and large companies took sites offline to patch. CISA gave no details on who is exploiting the bugs, but its statement followed researcher reports of exploitation evidence.

   Technical Details

   • The two vulnerabilities went undiscovered for years. They were first identified about two years ago, but the maintaining foundation judged them practically unexploitable and left them unpatched.
   • Researchers at Calif later found a way to exploit the two dormant bugs with the help of an AI model, including chaining the flaws together.
   • Building a working exploit was initially difficult but not impossible.
   • The article does not give CVE identifiers, IOCs or attribution.

   Remediation

   • Apply the latest PHP patches immediately. CISA set a three-day deadline for federal civilian agencies.
   • Prioritize internet-facing PHP servers, and monitor them for compromise, disruption and data theft.
2. theregister.com ↗ · pub. 26/10/2026 10:14 · coletado 26/10 11:00

   PHP2Shell memory-corruption flaws in PHP core expose ~70% of websites to RCE; exploitation attempts seen, no confirmed success

   ler a análise desta fonte ocultar

   PHP2Shell is the collective name for two related memory-safety vulnerabilities in the PHP core (a third was disclosed later) that can lead to remote code execution. They reportedly affect every PHP release of the past decade, back to roughly 5.4, and PHP is estimated to run about 70% of websites. The flaws were found in August by Calif (using OpenAI models) and independently by Wiz, and were handled under coordinated disclosure with the PHP Foundation. After leaks and a purported exploit video, the Foundation warned of emergency patches on Monday and released them on Wednesday. AWS reported exploitation attempts starting at least four days before the patches. As of Friday, the Foundation and the experts the outlet spoke to had seen no evidence of successful exploitation, despite many proof-of-concept exploits (some working, some not). Legacy servers on old PHP versions have no direct update path and remain exposed.

   Technical Details

   • Both flaws are memory-corruption bugs that let an attacker shape memory PHP trusts and hijack execution, leading to RCE, site takeover, data theft and malware delivery to visitors.
   • The attack chain is complex, which is why working exploits have been slow to appear.
   • VulnCheck developed an exploit showing that ASLR can be bypassed on x86 machines, so configuration-based mitigations are not a guarantee.
   • A third vulnerability was disclosed later. The PHP Foundation says it requires "a very unlikely combination of configuration and specific PHP application code" and will ship in the next regular release, not an emergency one. It can be mitigated with a configuration setting.
   • The patch for the current version is reportedly about 13,000 lines of C.
   • Downstream impact is wide: WordPress and most major CMSes are built on PHP, and some services (e.g. the Final Fantasy XIV login server) went offline during patching.

   Remediation

   • Apply the PHP Foundation emergency patches released Wednesday.
   • Systems on old PHP versions with no update path need to be taken down and rebuilt or reinstalled.
   • Apply the configuration-based mitigation for the third issue, bearing in mind the ASLR-bypass research.
   • Inventory indirect PHP dependencies, such as CMSes and applications built on PHP.
3. securityaffairs.com ↗ · pub. 24/10/2026 15:58 · coletado 24/10 17:00

   PHP2Shell PHP remote command execution flaw exploited four days before public disclosure, AWS honeypots show

   ler a análise desta fonte ocultar

   Security Affairs founder Pierluigi Paganini answers questions on PHP2Shell, a PHP flaw that can let attackers execute commands remotely on vulnerable servers. AWS researchers detected exploitation attempts against their honeypot network four days before public disclosure and patch release. The article notes that detected attempts do not automatically mean successful compromises. The piece stresses that attackers can weaponize flaws within hours, possibly with AI assistance, and that patch-only vulnerability management is not enough for internet-facing systems.

   Technical Details

   • The flaw allows remote command execution on vulnerable PHP servers. Impact depends on server configuration and privileges.
   • Possible consequences include data theft, malware installation, website defacement and use of the server as a pivot to attack other systems.
   • AWS honeypots recorded the first exploitation attempts around October 17, ahead of public disclosure.
   • AI-assisted analysis may shorten the time from technical information to a working exploit, but the article cautions against assuming every attack is AI-driven.
   • The article gives no CVE identifier, affected versions or IOCs.

   Remediation

   • Apply the relevant PHP security updates and check whether PHP applications are vulnerable.
   • Review logs for suspicious activity dating back to October 17, and investigate signs of compromise.
   • Restrict access to vulnerable services and apply temporary mitigations where patches are not available.
   • Maintain an inventory of internet-facing assets, continuous monitoring and tested incident response plans.
   • Users should use unique passwords and multi-factor authentication.
4. wired.com ↗ · pub. 24/10/2026 09:00 · coletado 24/10 10:01

   PHP2Shell: Millions of exploitation attempts hit newly disclosed PHP flaws within hours, with no confirmed successful compromise

   ler a análise desta fonte ocultar

   Criminal actors began probing the newly public PHP2Shell vulnerabilities in PHP within hours of disclosure, and Cloudflare observed millions of exploitation attempts. The PHP Foundation says it has seen no successful exploitation so far, and many publicly circulating exploits appear ineffective. Calif researchers first identified the flaws and built exploits in early August, partly using frontier AI tools through OpenAI's Patch the Planet program alongside expert human knowledge. Researchers at OpenAI and Wiz later found PHP2Shell flaws independently with AI tools. Some of the underlying issues were known in 2024 but were judged too complex to exploit, so AI effectively turned a long-dormant weakness into a present-day crisis.

   Technical Details

   • The flaws are collectively named PHP2Shell. The article gives no CVE identifiers, affected versions or technical mechanics.
   • Cloudflare's analysis shows mass opportunistic scanning and exploitation attempts shortly after publication.
   • Experts say AI is magnifying existing vulnerability discovery and disclosure dynamics rather than doing anything new. Sophisticated AI-aided finds still require skilled humans, and Calif's Ryan Austin wrote that no model can find "all bugs" with simple prompts.
   • Jake Williams (Hunter Strategy) expects more long-lived bugs to surface, but notes that few targets match PHP's internet-facing reach.

   Remediation

   • Apply the PHP patches for the PHP2Shell flaws as soon as they are available, prioritising internet-facing PHP applications.
   • Monitor web logs and WAF telemetry for exploitation attempts, and treat publicly circulating proof-of-concept code with caution.
5. itsecurityguru.org ↗ · pub. 22/10/2026 12:58 · coletado 23/10 23:00

   PHP2Shell: two critical PHP flaws exploited since Oct 17 after leak; emergency patches released, government sites taken offline

   The article adds the operational impact: government services in France, Denmark, Finland and the Netherlands, UK council sites, NHS Scotland and Wikipedia went offline. It also adds reports of millions of exploitation attempts with unconfirmed success, CERT-EU's isolation advice, OpenAI's statement that its model helped find the flaws, and post-exposure account hygiene guidance.

   ler a análise desta fonte ocultar

   The article adds the operational impact: government services in France, Denmark, Finland and the Netherlands, UK council sites, NHS Scotland and Wikipedia went offline. It also adds reports of millions of exploitation attempts with unconfirmed success, CERT-EU's isolation advice, OpenAI's statement that its model helped find the flaws, and post-exposure account hygiene guidance.

   Two critical vulnerabilities in the PHP engine, dubbed PHP2Shell, were fixed in emergency releases on 21 October 2026 after details leaked on 20 October, ahead of the scheduled disclosure. Amazon's threat intelligence team reported exploitation attempts dating back to 17 October, and the UK NCSC urged organisations to identify affected systems and update immediately. The article reports that government services in France, Denmark, Finland and the Netherlands, as well as UK council sites, NHS Scotland and Wikipedia, went offline, and that there were reports of millions of exploitation attempts. It is unclear whether any attempts succeeded. PHP rates both flaws 9.2, not the 10.0 some early reports cited. The flaws reportedly sat in code dating back to 2004 and were found with AI assistance, and OpenAI says its model helped find them.

   Technical Details

   • The flaws are in the PHP runtime itself, so updating WordPress or a framework does not fix them. PHP must be updated and the services that run it restarted.
   • The leak surfaced on Hacker News. PHP moved its security release up a day, the source of the leak is unknown, and there is no evidence a threat group was involved. No exploit code was released, but a screenshot of the researchers' exploit tool circulated.
   • Experts warn that AI lowers the effort needed for variant analysis and exploit development, and that attackers could distribute malicious "patches" while no official fix is available.
   • Forgotten PHP is likely in vendor appliances (NAS, firewalls, VPN portals, printers, building-management panels, OT/ICS HMIs), bundled runtimes in control panels, containers on old base images, marketing microsites, admin tools (phpMyAdmin, Roundcube, Nextcloud) and origins reachable directly behind a CDN or WAF. Older and EOL versions may never receive an official fix.
   • Hunting indicators: php-fpm, httpd or apache2 spawning sh, bash, curl, wget or base64; new or modified .php files in web roots; outbound connections from web worker processes.

   Remediation

   • Inventory all PHP use, prioritising internet-facing systems and not limiting the search to outdated versions. Combine external exposure scanning, host package managers, container/SBOM scans and network behaviour analysis.
   • Update to the latest PHP version, apply the PHP Team's hardening steps and restart services. Use the PHP Team's temporary mitigations if updating is not possible. If those cannot be applied quickly, the NCSC suggests taking the system offline. CERT-EU advised isolating internet-facing applications.
   • If compromise is suspected, rotate secrets on exposed hosts, filter multipart requests at the edge, restrict egress from web workers and isolate EOL hosts.
   • Review who has access to exposed sites and internal systems, remove unused admin accounts, apply least privilege, replace passwords and enforce MFA on every login.
   • Monitor third-party vendors for updates to products that bundle PHP, and validate patches against official release notes.
6. olhardigital.com.br ↗ · pub. 23/10/2026 12:17 · coletado 23/10 14:01

   Critical PHP flaws, first seen in a 2024 audit, trigger preventive takedowns of sites and Brazil's SEI

   ler a análise desta fonte ocultar

   The PHP Foundation confirmed that the first signs of the PHP vulnerabilities behind preventive site takedowns in several countries date to a 2024 external audit by Quarkslab. The fix stalled and restarted repeatedly because of limited resources and decision-making difficulties in the security team. The flaws could let attackers take control of servers without authentication. A security update is available. Since 21 October, governments and companies have temporarily suspended access to sites, including Anatel and Brazilian courts, which took down the Sistema Eletrônico de Informações (SEI). The article reports no major impact in Brazil so far.

   Technical Details

   • The vulnerabilities were identified in a 2024 audit by Quarkslab. The delay was attributed to the lack of a known remote command execution method at the time, difficulties in security team decisions, and a shortage of experts who know PHP internals.
   • Calif and OpenAI independently found and reported the flaws in August 2026. Wiz later found additional ways to exploit them, using Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol models.
   • Wiz called the findings among the most severe ever discovered in PHP and possibly in software history, saying they went unanswered for over a decade because discovery and exploitation were complex without AI.
   • The PHP Foundation uses AI tools such as Claude Mythos to analyze code and triage reports, but says they cannot determine the best way to structure a fix.
   • PHP is reportedly used by about 70% of sites, including platforms such as WordPress, Moodle and Magento.
   • The article gives no CVE identifiers, affected versions or evidence of active exploitation.

   Remediation

   • Apply the available PHP security update to affected systems; the article presents this as the main measure to reduce the risk of intrusion.
   • Preventive suspension of exposed services was used as a temporary measure by public bodies and companies.
7. digit.fyi ↗ · pub. 23/10/2026 07:30 · coletado 23/10 09:00

   PHP2Shell critical PHP flaws leaked, pre-disclosure exploitation surges to millions of attempts, Cloudflare reports

   ler a análise desta fonte ocultar

   Cloudflare reported millions of exploitation attempts after the disclosure of PHP2Shell, a set of critical PHP vulnerabilities rated 9.2 out of 10.0 that can theoretically allow unauthenticated remote code execution. CEO Matthew Prince said thousands of attempts were seen in the 10 hours before public disclosure, rising to tens of thousands within 45 minutes of the announcement and hundreds of thousands within 2 hours. The flaws leaked before the planned coordinated disclosure, so the PHP project released fixes on Wednesday ahead of schedule. Wiz researchers say AI helped turn long-dormant code weaknesses, present for over a decade, into a working exploit. Some high-profile sites were reportedly taken offline temporarily as a precaution.

   Technical Details

   • Wiz estimates that about 70 percent of the Internet is affected, given PHP's prevalence in platforms such as WordPress.
   • The vulnerable code is more than a decade old. Frontier AI models allowed a single researcher to build a working exploit in a week, work that previously would have taken a world-class team months.
   • Exploitation attempts began before the public disclosure, which indicates the leak was exploited ahead of patching.
   • PHP is often embedded in third-party products and applications, so asset discovery is difficult. The article does not give CVE identifiers, affected PHP versions or IOCs.

   Remediation

   • Apply the updates the PHP project has released across all PHP deployments.
   • Where patching is not yet possible, virtually patch with a Web Application Firewall (Akamai's recommendation) and consider taking exposed sites offline until patched.
   • Inventory where PHP runs, including embedded and third-party components (Accenture).
   • Maintain a 'lifeboat' continuity plan for critical operations while vulnerabilities are addressed (Accenture).
8. olhardigital.com.br ↗ · pub. 23/10/2026 05:00 · coletado 23/10 07:01

   Two critical unauthenticated PHP flaws force Anatel and Brazilian courts to suspend systems including SEI

   ler a análise desta fonte ocultar

   Two serious PHP vulnerabilities, reportedly allowing attackers to take control of servers without credentials, led Anatel and Brazilian courts to temporarily suspend access to their systems, including the Sistema Eletrônico de Informações (SEI). The Brazilian federal government issued an alert urging public bodies to update the software. According to the report, the flaws were identified with the help of artificial intelligence, and a fix is already available. The article is a newsletter digest and gives no CVE identifiers, exploitation evidence or technical details.

   Technical Details

   • Two flaws in PHP that may enable unauthenticated takeover of servers (no login or password required).
   • Discovery reportedly assisted by AI.
   • No CVEs, affected versions or evidence of in-the-wild exploitation are stated.

   Remediation

   • Apply the available PHP fix, as urged by the federal government's alert to public bodies.
   • Keep exposed systems suspended or restricted until patched, as Anatel and the courts did.
9. olhardigital.com.br ↗ · pub. 22/10/2026 12:24 · coletado 22/10 13:01

   Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline

   ler a análise desta fonte ocultar

   Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline. The flaws were found independently by Calif and OpenAI in August, and Wiz later found additional ways to exploit them using AI models. Wiz called them among the most serious PHP vulnerabilities ever found. The NSA recommended patching immediately or shutting down vulnerable systems, and French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency. The article does not give CVE identifiers, affected versions or evidence of in-the-wild exploitation.

   Technical Details

   • Two vulnerabilities in PHP allow actions on servers without credentials, which can lead to full server takeover.
   • Discovered independently by Calif and OpenAI in August 2026. Wiz later found further exploitation paths using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models.
   • PHP is cited as used by roughly 70% of websites and underpins platforms such as WordPress, Moodle and Magento.
   • Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. TSE was asked whether its systems are affected.

   Remediation

   • Update PHP to the fixed release, which is available.
   • Where immediate patching is not possible, take vulnerable systems offline or suspend external access.
   • Technically assess all services that use PHP.
10. itsecurityguru.org ↗ · pub. 22/10/2026 12:58 · coletado 22/10 13:00

    PHP2Shell: two critical PHP engine flaws leaked before disclosure, emergency patches issued, exploitation attempts since 17 October

    ler a análise desta fonte ocultar

    Two critical vulnerabilities in the PHP engine, collectively referred to as PHP2Shell, prompted emergency security releases on 21 October 2026 after details leaked on 20 October ahead of the planned disclosure. The UK NCSC urged organisations to identify affected systems and update immediately, and Amazon threat intelligence reported exploitation attempts dating back to 17 October. PHP rates both flaws 9.2 (some early reports cited 10.0). Commentators say the flaws could allow remote access without authentication, sit in code dating back to 2004, and were found with AI assistance. The article does not give CVE identifiers.

    Technical Details

    • The flaws are in the PHP runtime itself, so updating WordPress or other frameworks does not fix them. PHP must be updated and the services that run it restarted.
    • The leak surfaced on Hacker News two days before the planned disclosure, and PHP moved its security release up by a day. The source of the leak is unknown, no threat group involvement is evidenced, and no exploit code was released, although a screenshot of the researchers' exploit tool circulated.
    • Forgotten PHP is likely to be found in vendor appliances (NAS, firewalls, VPN portals, printers, building-management panels, OT/ICS HMIs), bundled runtimes in control panels, containers on old base images, marketing microsites and acquired-company infrastructure, admin tools (phpMyAdmin, Roundcube, Nextcloud), and origins reachable directly behind a CDN or WAF.
    • Older and end-of-life PHP versions in appliances and containers may never receive an official fix.
    • Hunting indicators suggested by commentators: php-fpm, httpd or apache2 spawning sh, bash, curl, wget or base64; new or modified .php files in web roots; outbound connections from web worker processes.
    • One expert warns that attackers could distribute malicious "patches" exploiting the rush to fix.

    Remediation

    • Inventory all PHP use, prioritising internet-facing systems and not limiting the search to outdated versions. Combine external exposure scanning, host package managers, container/SBOM scans and network behaviour analysis.
    • Update to the latest PHP version, apply the PHP Team's additional hardening steps, and restart services. Use the PHP Team's temporary mitigations if updating is not possible.
    • If mitigations cannot be applied quickly, the NCSC suggests taking the system offline until it is fully mitigated.
    • Monitor third-party vendors for updates to products that bundle PHP, and validate patches against official release notes.
    • If compromise is suspected, rotate secrets on exposed hosts, filter multipart requests at the edge, restrict egress from web workers, and isolate EOL hosts.
11. wired.com ↗ · pub. 21/10/2026 23:24 · coletado 22/10 00:01

    PHP2Shell critical PHP flaws exploited in the wild from Oct 17, four days before public disclosure and patches

    ler a análise desta fonte ocultar

    Amazon Web Services (AWS) research indicates that at least one actor began attempting to exploit two critical PHP vulnerabilities, collectively called PHP2Shell, on October 17. That was four days before the fixes and public disclosure on Wednesday, October 21, at 10 am ET. AWS found the activity by reviewing honeypot logs. The attempt came from an IP address linked to a "commercial anonymization network" (a proxy network or VPN). It remains unclear how the actor obtained exploit information while the flaws were under embargo. AWS CISO CJ Moses stated that "PHP2Shell is now being broadly exploited in the wild."

    Technical Details

    • Proof-of-concept exploits began appearing publicly on October 21, some apparently hours before the 10 am ET disclosure.
    • In the hours before disclosure, AWS honeypots received multiple exploitation attempts. They were anonymized through various providers and had seemingly different attack goals, likely indicating multiple actors.
    • AWS says technical analysis is ongoing and it is unclear whether any of these attempts would have succeeded against real-world systems.
    • Attackers also reverse engineered the fixes to learn how to exploit the flaws.
    • AWS argues that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, so more actors can act within hours or minutes of disclosure.
    • The article does not give CVE identifiers, affected versions or IOCs.

    Remediation

    • Administrators raced to identify and patch vulnerable websites and apps after the fixes were released on October 21.
    • Some governments and other groups proactively took key websites offline ahead of the release so they would not be targeted before patching.
    • AWS says coordinated vulnerability disclosure must evolve and speed up.
12. olhardigital.com.br ↗ · pub. 21/10/2026 17:55 · coletado 21/10 20:01

    Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline

    ler a análise desta fonte ocultar

    Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Foundation described the delay in fixing it as a structural process failure. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may reverse-engineer the patches to target unpatched systems.

    Technical Details

    • CERT-EU confirms the flaws permit remote code execution without authentication or an account.
    • Possible impact: data theft, web page defacement, or full system compromise. The NSA warned they could expose server files and databases.
    • PHP runs on nearly 70% of sites whose server-side language can be identified, and underpins WordPress (about 40% of websites). Many organizations may not know they are running PHP in third-party products, CMSs or hosting platforms.
    • Discovery: Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw on 11 August. Wiz independently found the issues and reported a second flaw on 24 August, also using AI models.
    • Don Smith (Sophos CTU) warns that exploitation could be prioritized within hours or days of patch release, including with AI assistance.

    Remediation

    • Apply the PHP updates immediately; if not possible, isolate or take vulnerable systems offline (NSA, CISA).
    • Inventory all PHP instances, including third-party components, and prioritize internet-facing services.
    • Confirm affected versions against official advisories.
    • Monitor PHP and web server processes for unusual activity or unexpected command execution, and check whether compromise occurred before patching.
13. darkreading.com ↗ · pub. 21/10/2026 16:19 · coletado 21/10 18:00 só resumo do feed

    Two critical PHP vulnerabilities ('PHP2Shell') under exploitation attempts after leaked details

    ler a análise desta fonte ocultar

    Security teams are racing to remediate two critical PHP vulnerabilities, collectively dubbed PHP2Shell, after technical details leaked and exploitation attempts were reported. The article excerpt gives no CVE identifiers, affected versions or attribution. The name suggests a path to shell access, but the excerpt does not confirm the impact. Given PHP's footprint across web infrastructure, defenders should treat this as urgent while waiting for vendor guidance.

    Technical Details

    The available text states only that there are two critical vulnerabilities, that details have leaked, and that exploitation attempts have been reported. It gives no root cause, affected versions or indicators.

    Remediation

    The excerpt gives no specific remediation steps. Monitor PHP project advisories and apply patches once available.

14. techcrunch.com ↗ · pub. 21/10/2026 14:59 · coletado 21/10 16:00 primeiro registro

    NSA warns of two critical decades-old PHP flaws found with AI by OpenAI/Calif and Wiz; patched in PHP 8.5.12

    ler a análise desta fonte ocultar

    The NSA issued a warning on Wednesday about two critical vulnerabilities in PHP, present in all versions since PHP 5 (2004). The PHP Foundation has already released patches. The flaws let attackers reach the server file system or the database used by the web application. The NSA advises that any site that cannot be patched immediately should be taken offline until it can be. No in-the-wild exploitation has been reported so far, but public disclosure starts a race to patch tens of millions of sites.

    Technical Details

    • One flaw was found by the security firm Calif, working under OpenAI's "Patch the Planet" initiative with GPT-5.6 Sol. Separately, Wiz found multiple PHP vulnerabilities using its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol.
    • The flaws were previously considered too hard to exploit. Wiz warns that LLMs can now help adapt exploits to different PHP versions, configurations and memory layouts, which lowers that barrier.
    • PHP is reported to power roughly 70% of websites (over 33 million sites) and underpins CMSes such as WordPress. WordPress says the issue is not WordPress-specific.
    • The article gives no CVE identifiers or technical root causes.

    Remediation

    • Update to the current PHP release, 8.5.12. PHP 8.1 and older are unsupported, so those sites need to be upgraded.
    • Pull sites offline if they cannot be patched immediately (NSA guidance).
    • WordPress site owners must patch their servers and work with their hosting providers.
    • Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping validate the patches.