Is the Internet Safe Again After the PHP Nightmare? What You Need to Know
Two PHP flaws, dubbed PHP2Shell, allow unauthenticated attackers to take control of vulnerable web servers. PHP released patches, but administrators must install them; older unsupported versions remain exposed, with about 884,000 internet-facing hosts reportedly running versions without official fixes. Cloudflare recorded millions of exploit attempts, and Amazon saw activity before public disclosure, though governments reported no confirmed successful attacks and no related data breaches or crypto exchange compromises have been disclosed. Several government, healthcare and other websites temporarily went offline. The PHP Foundation acknowledged delays in fixing one flaw and said it would change its security decision process. Users should beware of fake websites and wallet-draining prompts; server operators should patch, investigate possible intrusions and rotate exposed credentials.
