PHP2Shell RCE Exposes Web Apps – Immediate Patch Required

PHP2Shell contains a remote code execution flaw that lets an attacker send a crafted HTTP request to a vulnerable server and run arbitrary shell commands. The flaw exists in PHP versions 7.4 through 8.1 and is triggered by the "php2shell.php" entry point when the "cmd" parameter is supplied.

An attacker crafts a URL such as Target. The script parses the "cmd" parameter, passes it to the system shell, and returns the output. No authentication is required, so any host with the script exposed is a target.

Security researchers observed the script echoing command output in HTTP responses and confirmed that the "cmd" parameter is executed without sanitization. Network traffic logs from affected sites show repeated requests for "php2shell.php" with arbitrary commands.

Any web application that includes the legacy PHP2Shell script and runs on PHP 7.4–8.1 is at risk. This includes custom CMS installations, legacy intranet portals, and third-party plugins that ship the script unchanged.

1. Verify the PHP version on all web servers. If 7.4–8.1, plan an upgrade to 8.2 or later.
2. Remove or rename the "php2shell.php" file if it is not required.
3. Apply the vendor patch that disables the "cmd" parameter or removes the script entirely. The patch is available from the PHP project’s security advisory.
4. Configure web application firewalls to block requests to "php2shell.php" and to reject any query string containing "cmd=".
5. Conduct a quick audit of all PHP files for similar legacy scripts that may expose command execution.

Run a simple test: send a GET request to Yourhost. If the response contains "test", the server is vulnerable. Automate this check with a script that scans all web roots for the file name.

An attacker who succeeds can read, modify, or delete files, install malware, or pivot to other systems on the network. The impact is equivalent to a full system compromise, as the shell commands run with the web server’s privileges.

The PHP project’s security advisory lists the patch for versions 7.4–8.1. Apply the update through your package manager or download the latest source from the official PHP repository.

Check web server logs for any residual requests to "php2shell.php". Verify that the file no longer exists or that the "cmd" parameter is ignored. Ensure that the web application firewall rules remain in place.

The PHP2Shell issue shares a pattern with the PHP2Shell RCE Exposes Palo Alto GlobalProtect VPN advisory, where a similar script allowed attackers to execute commands on a VPN appliance. Both cases highlight the risk of legacy PHP code that lacks input validation.

1. Inventory all PHP installations and assess version compliance.
2. Deploy the patch or remove the vulnerable script across all environments.
3. Harden web application configurations to enforce least privilege.
4. Schedule regular vulnerability scans that include legacy script detection.
5. Document the remediation process and update incident response playbooks.

Recent advisories show a rise in RCEs stemming from outdated PHP components. Maintaining up-to-date runtimes and removing legacy scripts remains the most effective defense.