PHP2Shell is the name for two critical flaws in PHP that were announced on October 20 and patched on October 21. PHP runs about 69% of websites, including most WordPress, Drupal and Joomla sites, and these flaws let someone run their own code on a site's server without logging in. If your site runs on PHP you should update it now.

What happened?

Researchers at Calif and Wiz each found the bugs in August, using AI models to help read through PHP's code. The flaws are in PHP itself and go back to PHP 5.4, which came out in 2012. Details leaked before the planned release so the fixes went out early, and some security companies say they have already seen people trying to use them.

The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions 7.4 through 8.1 are no longer supported and do not get an official update, so sites on those need to move to a newer version.

Why are PHP sites exposed?

A typical PHP site runs PHP on its server every time someone loads a page, and that server can be reached from the internet all the time. One of the flaws happens before any of the site's own code runs, so even a well built site with every plugin up to date is exposed until the server itself is updated. Depending on the setup that is the host's job or whoever manages the server, and I think a lot of sites are on older PHP versions than their owners realize.

How does a Next.js site on Vercel avoid this?

Our sites do not use PHP at all. Most pages are built ahead of time and served from Vercel as finished files, so there is no PHP server for anyone to reach. Content is managed in a headless CMS like Sanity, which is hosted separately from the website. Editors log in there and the public site only pulls the content in. When code does run on a server, Vercel manages and updates that server, so patching it is not on us or our clients.

Is a modern stack the better choice going forward?

Yes, especially with more of these on the way. Both PHP2Shell flaws were found by researchers using AI, and as those tools get better more discoveries like this are going to come out in all kinds of software. Next.js had its own critical flaw last December called React2Shell, Vercel put firewall rules in place for every project on the platform and the fix on our end was updating a package and redeploying. With more of these coming that is the setup I would want to be on.

If you have questions about where your site stands we are happy to talk through it.