CONNECT WITH US
AI & Deeptech

AI & Deeptech

“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response

TheNewStack (AI) - ArtificialIntelligence logo

Published on

Add as a preferred source on Google
“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response

The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.

We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.

But does that mean people are patching their servers as fast as they can?

To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“

“…remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild”

Bustan goes on to write, “Remediation is too slow, while everyone panics about PHP CVEs, remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild… we missed the opportunity to actually get our patches out the door – and now, when exploits are out there, proven in the wild and not just speculation – we’ve left our most precious assets exposed for the next hacker to take advantage of.”

It’s not just Ox reporting abysmal PHP2Shell patch numbers. 2 million Internet-facing PHP services are reporting patched versions . That’s not as impressive as it sounds. These counts are based on the PHP versions servers report, and because Linux distributions often backport fixes without changing the version number, some “vulnerable” services may already be patched.


Source link
Related Topics:AI & Deeptech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.