Hackers exploit PHP2Shell vulnerability, compromise 1,200 servers in four days

Hackers began probing a critical PHP2Shell vulnerability on June 15, four days before security researchers publicly disclosed the flaw, giving the attackers a brief but dangerous head start. The bug, a remote‑code‑execution flaw in the popular PHP‑based content‑management system PHP2Shell, allows an unauthenticated user to upload a web shell and take full control of a server. The vulnerability was first reported to the software’s maintainers on June 19, and a patch was released the same day, but by then attackers had already scanned thousands of sites for the exploit.

The discovery comes amid a wave of attacks targeting outdated web‑application frameworks. PHP2Shell, once a go‑to tool for building simple sites, has not seen a major update since 2020, leaving many installations vulnerable to known exploits. Researchers say the four‑day gap is not unusual; attackers often monitor vulnerability disclosure channels and act quickly once a flaw is announced. In this case, automated bots began probing for the specific payload pattern on June 15, indicating that threat actors were already aware of the issue through private channels or early leaks.

Security firms have logged at least 1,200 compromised servers linked to the PHP2Shell bug, with most victims being small businesses and hobbyist blogs that run outdated versions. The maintainers have urged users to apply the June 19 patch immediately and to audit their servers for any lingering web shells. Hosting providers are now scanning for the signature and blocking suspicious traffic. Analysts warn that the window of exposure, though short, shows how quickly a zero‑day can be weaponised. Going forward, experts recommend regular software updates, automated vulnerability scanning, and a shift away from legacy platforms like PHP2Shell to more actively maintained frameworks.