So it hits WordPress, Drupal, Joomla and custom PHP sites alike. Two critical flaws — found by AI, live in the code for over a decade — let an attacker take over a server with no login and read the passwords, session tokens and API keys sitting in its memory.
No obligation. We'll respond within one business day.
The same flaw, the same exposure — whatever the CMS. Only the architecture underneath changes the answer.
The fix stops new attacks. It doesn't undo what the flaw already exposed — and it can't reach code you don't know you're running.
The vulnerable code survives in PHP processes that were never restarted, in old container images, and in vendor appliances and hosting panels.
Many servers hide their PHP version, so scans wrongly report them clean.
CISA: PHP “may not be directly observable.”
The flaw leaks server memory — passwords, session tokens and API keys. If a server was reachable from the internet before the patch, assume those secrets were exposed.
Credentials have to be rotated and systems checked for compromise.
Guidance echoed by ProjectDiscovery & Qualys.
Many organisations couldn't even count how many PHP sites and services they run. The question is no longer whether you can patch — it's how often you'll have to.
Architecture should assume critical vulnerabilities keep arriving.
NSA, FBI & CISA urged immediate fixes.
PHP2Shell lets an unauthenticated attacker read server memory and reach the file system or database. The most sensitive data often sits on forms, uploads and vendor portals — outside core security controls.
Staying live during a news peak. Ireland's #2 news site went offline to protect itself. For a publisher, uptime during a major story is editorial credibility.
KYC documents (PAN, Aadhaar), loan applications, investor files, and API keys into core and CRM systems. One leaked key can open far more than the website.
Patient names, appointment history, lab reports, prescriptions and insurance details — often on report-download portals that sit outside core IT.
Test-drive and booking leads, finance pre-approvals and dealer-network logins — collected at scale on agency-run microsites.
Not because we patched faster — because the attack surface that PHP2Shell targets isn't how the platform is built.
Headless, API-first architecture. The plugin ecosystems that balloon the WordPress and Drupal attack surface simply aren't there.
Hosting, backups, monitoring and patching handled by Publive — not your team, not your agency. Resilience built in, not delivered in an emergency.
SOC 2 and ISO 27001 certified controls — evidenced, monitored and maintained by us, with a documentation pack ready for your CISO and DPO.
Built for regulated industries and news-peak traffic alike, so your team focuses on the work — not the patch cycle.
Get a free exposure review of your public sites, forms and portals — which ones touch sensitive data, where that data flows, and what to rotate now. Whether or not Publive ends up being part of the answer.
Tell us where to send it. We'll respond within one business day.
