A security firm says a flaw called PHP2Shell could let attackers run code on PHP websites. The claim is unconfirmed, but fixes are reportedly coming soon.
A security firm named watchTowr is reportedly warning of a serious flaw in PHP, the programming language behind a large share of websites. The flaw, called PHP2Shell, could allow remote code execution. That means an attacker could run their own commands on a website's server from afar. The report has not been confirmed.
According to the report, the exploit allegedly affects every version of PHP since PHP 5, which came out in 2004. That covers a very long stretch of software. The vulnerabilities are believed to be uncommonly severe. Fixes are reportedly scheduled to be released soon. The report was covered by Dan Goodin at Ars Technica.
Anyone whose website runs on PHP could be touched. That includes WordPress sites, custom business portals and web apps, plus the agencies and hosts that run them. Many owners do not know what their site is built on. A quick question to a developer or host will settle it.
The material does not say how the flaw works, whether attackers are using it now, or exactly when the fixes will arrive. It also does not say which setups are most at risk. Treat the details as unsettled until PHP itself publishes an official security release.
The alert box above lists the steps. The short version: find out whether your sites use PHP, be ready to install the fix the day it appears, and make sure a recent backup exists first.
Watch for the official PHP security release. Once it is out, the report will either be confirmed or corrected, and updating promptly will matter most for any site that depends on PHP.
Ask your web provider today whether your site runs PHP, and be ready to apply the fix as soon as it is released.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
