Millions of Intrusion Attempts: A PHP Vulnerability Is Sweeping the Internet
How this was made Verified AI
Every Intellegix briefing is generated from that day's broadcast and run through automated checks before it publishes — with a human paged on any flag. Here is the trail for this edition.
Cloudflare reported millions of PHP2Shell exploit attempts striking web infrastructure globally, and Amazon Web Services followed by confirming that the vulnerabilities were being 'broadly exploited' — a term that in security parlance signals the campaign had moved from targeted attacks to automated, indiscriminate scanning. The most telling indicator of severity: governments began pulling their own websites offline proactively to avoid compromise.
PHP underpins an enormous share of internet infrastructure — WordPress, Drupal, and many government portals all run on it. The PHP2Shell technique works by locating vulnerable file-upload functionality within a PHP installation and planting a web shell, essentially a persistent backdoor granting remote access to the server. Once in place, an attacker can execute commands, exfiltrate data, and move laterally through connected networks. The scale of attempts Cloudflare described — millions — indicated an automated scanner probing IP ranges at machine speed, consistent with either criminal botnet-building, ransomware pre-positioning, or both.
The economic and civic costs were not abstract. Every government website taken offline represented disrupted services — permit applications, benefits portals, licensing systems — affecting real people trying to interact with their governments. Organizations successfully compromised faced remediation costs that could reach millions of dollars per incident, plus regulatory exposure where personal data was involved. A supply chain dimension compounded the risk: a compromised government contractor's PHP portal could become a vector into the agencies those contractors served.
Patch guidance for administrators was described as straightforward: update PHP to versions addressing the file-upload validation vulnerabilities, audit web-accessible directories for already-planted shells, and review server logs for request patterns characteristic of PHP2Shell attacks. The timing — Thursday morning ahead of a weekend — was noted as deliberately advantageous for attackers, who have historically moved when IT staffing thins heading into Friday afternoon.