A significant vulnerability known as PHP2Shell affects 96% of devices running PHP on corporate internal networks. This vulnerability allows attackers to remotely seize control of a system without needing separate authentication, according to sources.
The majority of the affected devices, 78%, are running PHP 8.1 or earlier, versions that are no longer officially supported. Notably, 48% of these vulnerable devices are operating on PHP version 5.x or earlier, which lost support in 2018.
Devices impacted by PHP2Shell include traditional servers, which account for 24%, CCTV and video recorders and security solutions at 20%, and IoT devices such as RFID readers at 17%.
A large portion, 89%, of the identified devices are located on private IP ranges, making them unreachable by internet search engines and external scanners.
PHP2Shell has been confirmed as actively exploited, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding it to their Known Exploited Vulnerabilities catalog on October 26. Attackers have broadened their intrusion paths beyond web servers to include NAS, routers, and firewalls on corporate networks.
In South Korea, there have been reports of multiple ransomware infections targeting vulnerable storage devices, highlighting the potential impact of the PHP2Shell vulnerability.