PHP2Shell: Helping Defend the Systems That Are Hardest to Patch

Two weeks after PHP2Shell patches were released, at least 32% of government and military organizations in Dream’s observed sample were still reporting affected PHP versions. Those remaining exposures spanned nine countries. Among military organizations, the rate was 57%, more than twice the 26% observed among civilian government organizations.

Nearly 80% of the affected IPs in that sample reported end-of-life PHP branches that no longer receive official PHP releases. For these systems, remediation may require a tailored backport or migration to a supported branch.

To understand how the response was progressing, we examined publicly available internet-scan data from Censys, using government, military, and education domain identifiers to select systems for review. We compared the same systems identified on October 22, one day after patch release, against their latest available scan results on November 4. The figures above focus on the government and military subset.

This is a view into a selected sample, rather than an estimate for all governments. Version reporting also has limits: some systems stopped revealing their version or disappeared from view, while others may have received vendor backports without changing their advertised PHP version.

Even with those limits, the persistence of older, affected-version deployments deserves attention.

Sophisticated actors are already finding a way in

Early exploitation reporting offered some reassurance. In its October 27 update, Wiz reported attempts but no successful exploitation in its own telemetry. Yet sophisticated actors were already demonstrating that a carefully adapted exploit could succeed.

For example, Dream uncovered a campaign that chained PHP2Shell with a Linux kernel vulnerability to compromise 25 servers. The actor filtered targets across four countries, then concentrated on a US government-affiliated environment. From an exposed firewall, the attacker reached an internal management server, extracted credentials, and enumerated the organization’s directory.

The initial exploit chain completed in under 15 minutes. The subsequent intrusion showed how one exposed device could open access to much more consequential systems.

I’m not surprised. Fifteen years at the intersection of cybersecurity and national infrastructure have taught me that some of our most critical systems are also among the hardest to secure.

The long tail of legacy systems

Many PHP deployments can be patched through a straightforward update. The harder problem is the legacy estate reflected in our findings.

Government infrastructure accumulates over decades, across agencies, vendors, and maintenance teams. An older PHP runtime can sit inside a security appliance or underpin an essential application. Finding it is one task. Understanding what will break when it changes is another.

Updating that runtime can trigger changes to applications, libraries, and integrations. When remediation requires full migration, the timeline can stretch substantially. MobiDev’s project-based estimates range from three to six weeks for a small, maintained application to six to twelve months or more for a large legacy system.

Sovereign environments add constraints. Teams handling sensitive code and infrastructure cannot necessarily use external AI coding services. Assistance must operate within their security and sovereignty requirements.

Meanwhile, essential services must keep running.

A fix needs to survive testing

Temporary workarounds can create false confidence. PHP’s own advisory warns that configuration changes may block specific attack paths without making an installation safe. Removing PHP’s memory limit, for example, requires separate safeguards against memory exhaustion and service disruption.

Defenders must establish that a fix closes the vulnerability, preserves application behavior, and avoids unacceptable operational risk. A successful build or one blocked exploit attempt is insufficient.

We use Hero, Dream’s autonomous cyber research team, to help government and critical infrastructure partners do that work. Its autonomous patching pipeline combines tailored patch development with vulnerability and operational-impact validation, followed by expert review before deployment. Hero can operate within sovereign environments, keeping sensitive research inside the organization’s control.

It can also analyze exploit tooling and derive signatures to help defenders investigate whether systems have already been compromised.

The people protecting essential services need access to the most sophisticated technology available. They need the capacity to investigate unfamiliar code and validate a fix while keeping critical systems running. We built Hero to put that capacity in their hands.

We’re extending that help to governments and critical infrastructure organizations facing PHP2Shell exposure. If a legacy PHP deployment is proving difficult to patch, use the form below to tell us where you need help.