PHP2Shell

PHP2Shell is a family of critical vulnerabilities (CVSS 9.2) recently discovered in core PHP that allow unauthenticated attackers to execute code or access sensitive process memory, affecting approximately 70% of websites including WordPress, Drupal, and Wikipedia. The vulnerabilities stem from memory-safety issues in PHP's core engine—specifically out-of-memory handling corruption and stale global state—and can compromise websites even with secure application code. PHP has released patches to address these issues, and sites running the latest patched versions are protected.