PHP releases fixes for PHP2Shell vulnerability but manual installation is required

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address PHP2Shell, a flaw allowing unauthorized server control on about 70% of websites. However, the fix requires manual installation and PHP restart by every hosting company or website owner; it does not apply automatically. Cloudflare CEO Matthew Prince said exploit attempts have climbed into the millions, though Germany's BSI and Japan's government have not confirmed any successful break-ins. PHP Foundation called the delay in fixing the flaw a "structural failure."