Kazakhstan’s National Computer Emergency Response Team KZ-CERT has issued an urgent warning to local website administrators and owners. Two critical vulnerabilities, collectively known as PHP2Shell, have been discovered in PHP, a popular programming language used by the vast majority of websites in the country. The flaws could allow attackers to execute code remotely without authentication.
The nature of the critical threat
Both vulnerabilities have received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS). The flaws stem from memory-management errors in PHP’s core, some of which have been present in the code since 2012.
An attacker can trigger a memory failure on the server by sending a specially crafted HTTP request. This can enable remote code execution and expose confidential data stored in the PHP process’s memory, including passwords, API keys and session tokens.
Millions of websites and popular platforms at risk
The vulnerabilities may affect a wide range of websites and content management systems (CMS) used by Kazakhstan’s media outlets, online stores, businesses and government services. Platforms and applications that rely on PHP include WordPress, Laravel, 1C-Bitrix, Magento, Drupal, Joomla, Symfony, Nextcloud and phpMyAdmin
Security specialists stress that fixing the website’s code or web application will not protect against attacks, as the vulnerability lies within PHP’s core.
«Since the vulnerabilities exist directly within the PHP core, modifying the source code of a web application does not fully eliminate them. Updating the server-side PHP environment is necessary to ensure protection,» KZ-CERT warned.
How to secure servers and websites
PHP developers have already released emergency security patches. To fully address the vulnerabilities, administrators should update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and restart the relevant processes and web servers.
As temporary measures before patching, experts recommend disabling upload-progress tracking, limiting the size of incoming requests and increasing monitoring for suspicious activity in server logs. These measures can reduce risk but do not replace installing the security updates.