{
  "id": 16798906,
  "title": "“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response",
  "url": "https://urgent.news/2026/10/27/the-panic-hasnt-turned-into-patching-what-security-researchers-really",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T20:54:37.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/php2shell-unpatched-php-servers/"
  },
  "original_language": "en",
  "account": "The recent PHP2Shell vulnerability, a pair of critical PHP vulnerabilities with a high CVSS score of 9.2, has raised concerns among security researchers. Despite the panic following its disclosure, the findings suggest that remediation efforts have been slow and insufficient. According to Moshe Siman Tov Bustan of Ox security, \"The panic hasn't turned into patching.\" Ox's research indicates that as of October 26, five days after the disclosure, 93.6% of servers remain vulnerable. The slow pace of remediation is exacerbated by the presence of more headlines about the issue than actual fixes in the wild. Censys, a security company, reported that only 11.2 million Internet-facing PHP services have been patched, with 32.5 million still running vulnerable versions. Moreover, 61,303,506 services have yet to be identified, many of which may be running unsupported versions of PHP. Other studies have found similar results, with nearly three-quarters of tracked PHP services advertising unsupported branches, and 73.5% of surveyed services running unsupported versions. As the threat persists, some organizations have taken action, such as the Wikimedia Foundation and Internet Archive, while others have permanently shut down due to the vulnerability. Governments, including the US, have also mandated PHP2Shell remediation, but the task remains daunting. PHP2Shell attacks are ongoing, and initial attempts have surged to millions within hours of the announcement.",
  "summary": "The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up. We The post “The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response appeared first on The New Stack .",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "CISA confirms PHP2Shell under attack as researchers clock successful exploits",
        "url": "https://urgent.news/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful",
        "published": "2026-10-27T14:45:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}