PHP2Shell: Two Unauthenticated Remote Code Execution Vulnerabilities in PHP (CVSS 9.2); MODA Estimates ~28,000 Websites Affected in Taiwan

Vulnerability Details

According to a TWCERT/CC advisory, both vulnerabilities can lead to unauthenticated and each carries a v4.0 base score of 9.2, with vendors noting that Apache mod_php environments face the highest risk ^[1]. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and earlier branches no longer receive official releases, though minimal source-code patches are available for 7.4, 8.0, and 8.1 ^[1].

Exploitation Status

CERT-EU noted that initial proof-of-concept (PoC) code is already circulating, while Amazon threat intelligence teams reported detecting exploitation attempts in honeypots on October 17—four days prior to public disclosure ^[1][2]. U.S. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities () catalog ^[2].

Impact in Taiwan

On October 22, the Administration for Cyber Security (ACS), MODA stated that it had initiated incident response measures, requiring government agencies and enterprises to prioritize updates, apply WAF or other mitigations if immediate patching is infeasible, and suspend web services if necessary; MODA inventoried approximately 28,000 public-facing PHP websites in Taiwan, including about 200 government agency sites ^[2]. On October 29, following reports that certain firewalls and networking appliances might also be affected by PHP2Shell, ACS urged all organizations to check whether management interfaces are exposed to the internet and them promptly ^[3].