Critical PHP2Shell RCE Attempts Target WordPress, Drupal and Joomla

Key points

• Remote code execution attempts target PHP-powered CMS deployments.
• WordPress, Drupal and Joomla installations are in scope.
• Sensor telemetry shows active exploitation, not only scanning.
• Patches are available; no CVE identifiers are listed.
• Treat exposed systems as critical until patched and verified.

A wave of exploitation attempts is targeting PHP environments that support WordPress, Drupal and Joomla installations. The activity is associated with PHP and a PHP2Shell exploit reference, and the objective is remote code execution. Telemetry from sensors indicates that attackers are actively trying the exploit rather than merely probing for vulnerable hosts. No CVE identifiers are attached to this activity in the available facts, so defenders should not wait for a CVE-based alert before acting.

The affected population is broad: any organization running one of these content management systems on PHP could be exposed if the relevant patch is missing. Because these platforms are common for public-facing websites, including school and government sites, successful exploitation could allow an intruder to run commands on the server. That creates risks to website integrity, data confidentiality and downstream services.

The vendor response includes a patch release, but exploitation has already been observed. Sensor detections give defenders a signal to hunt for attempts and confirm whether any succeeded. The absence of a CVE number does not mean the absence of risk; it means tracking and communication may rely on vendor advisories and internal telemetry.

Remote code execution is among the most severe web-facing outcomes. For K-12 and government operators, a compromised CMS can become a foothold for lateral movement or public defacement. Watch for exploit attempts in web logs, unexpected PHP process behavior, new files in web roots and signs of unauthorized administrator access. Prioritize patching and verification over waiting for broader threat intelligence.

What to do now

1. Inventory all WordPress, Drupal and Joomla instances, including PHP versions and current patch levels.
2. Apply the vendor patch release immediately to internet-facing CMS and PHP deployments; avoid unnecessary delay for staging tests during emergency rollout.
3. Search web server, WAF and CMS logs for exploitation attempts against PHP endpoints and preserve evidence.
4. Deploy virtual patching or WAF rules for known PHP2Shell exploit patterns until all systems are patched.
5. Check web roots for unexpected files, modified timestamps and suspicious PHP processes; rotate secrets if compromise is suspected.
6. Restrict administrator interfaces and disable unused plugins, modules and themes; enforce least privilege.
7. Report confirmed compromises to incident response and monitor sensor alerts for renewed exploitation activity.

Original source

SecurityWeek