Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Risks / R03 Exploitation outpaces patching / R03-2
R03-2: Mass scanning and mutated payloads after the leak
Because tens of thousands of attempts followed the announcement and attackers mutated payloads, every internet-facing PHP server was tested within hours, resulting in exposure measured in hours, not weeks.
Rating 20 critical · Likelihood 5 Happening · Impact 4 Major · Kind Security · Acceptance not recorded
Basis. Reported by Cloudflare's CEO and confirmed as probing by Amazon and Cloudflare.
The path
Who carries it
One risk, assigned to every stakeholder that carries part of it, with the part each plays.
| Stakeholder | Part | Why | Its register |
|---|---|---|---|
| WAF vendors | treater | Absorb the scanning. | 2 risks |
| Organisations running PHP | owner | Every server was tested; only its operator can patch it. | 26 risks |
What it arises from
- A filter in front of an unpatched engine. Rules match the payload shapes seen so far; attackers mutate payloads, and only traffic routed through the filter is covered.
The evidence
Treatments
| Treatment | Status | Where |
|---|---|---|
| Edge rules from every major vendor | partial | Detection and defence: what blocks php2shell and what shows it |
The standards that govern it
| Framework | Control | What it asks | Family |
|---|---|---|---|
| MITRE ATT&CK | T1595.002 | Active scanning: vulnerability scanning | Practice and technique |
| NIST CSF 2.0 | DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Frameworks and control catalogues |
| CIS Controls | 13.10 | Perform application layer filtering | Frameworks and control catalogues |
The stories that tell it
- Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third (through Exploitation outpaces patching)
- Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit (through Exploitation outpaces patching)
- php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through Exploitation outpaces patching)
On this site: Exploitation signals, in order · Detection and defence: what blocks php2shell and what shows it