PHP2Shell reports unauthenticated code execution risks in core PHP
PHP2Shell describes a family of critical vulnerabilities in core PHP.
R/PROGRAMMING (TOP) — According to the project, an attacker who needs no authentication may execute code or read sensitive process memory. Its testing reportedly achieved remote code execution against WordPress, Drupal and Joomla using the latest container images available at that time. The excerpt provides no CVE, affected versions or patch details.
The PHP2Shell project describes a family of critical vulnerabilities in core PHP. Its summary says the flaws may let attackers without authentication execute code or expose sensitive memory belonging to the process.
The project says it demonstrated remote code execution against WordPress, Drupal and Joomla. The tests used the latest container images available at the time. The supplied material gives no CVE identifiers, affected PHP versions, remediation guidance or evidence of exploitation in the wild.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.