What Is PHP2Shell? How To Stay Safe After the PHP “Hack”

On October 21, cybersecurity researchers publicly announced that they had uncovered multiple “critical vulnerabilities” in PHP, the backend programming language that powers 70% of all websites worldwide. They named these vulnerabilities PHP2Shell. 

In the wrong hands, the PHP vulnerabilities could allow hackers to take control of affected servers and steal sensitive data, including passwords, financial data, and other personal information. 

The PHP2Shell vulnerability isn’t like a traditional data breach — instead, think of it as a “master key” that lets hackers bypass security measures on unpatched servers. 

The good news is that a patch has already been released to “fix” the issues. Many large websites that use PHP have already secured their systems. Others have taken their sites offline voluntarily to prevent a data breach or hack.  

For example, Amazon told the BBC that its systems were targeted multiple times in the days leading up to the public disclosure of the issue, but that its websites are operating as normal. 

Here’s what you need to know about the PHP vulnerability and what it means for your online safety:

What is PHP? 

PHP is an open-source backend programming language used by 70% of the world’s websites ranging from major platforms like Facebook to government databases and hundreds of thousands of independent e-commerce stores.

The easiest way to think of PHP is as a translator — it turns server data into a website that you can read. For example, when you click a button, PHP runs in the background to grab relevant data from a website’s server and “build” the proper website for you. 

What is the PHP2Shell vulnerability? 

The PHP2Shell vulnerabilities allow hackers to potentially bypass security measures and directly access a server’s database and all of the information it houses — such as account details or payment information.

Cybersecurity researchers at Wiz said that the underlying security flaws were inherent in PHP itself, and had been present for decades. 

Why does the PHP vulnerability matter to you?

The PHP vulnerability means that any unpatched server that uses PHP is potentially at risk. This is especially true of smaller online stores or websites that don’t regularly implement security patches. 

While it’s too early to know the exact sites or services that were impacted, here are some of the biggest risks facing the average online consumer: 

• Your payment details and personal information could be stolen. While many major sites and tech platforms are quick to implement patches, smaller online stores are targets for credential theft, data breaches, or card skimming. 
• Account takeovers and malware. Hackers who access a website’s servers can potentially inject malicious code to silently infect your personal device with malware or steal your session cookies when you log out.  
• Increased phishing attacks. Hackers can capitalize on the vulnerability news to send phishing campaigns pretending to be an urgent “security patch” or “account security” alert. Leaked information can also end up for sale on the dark web, where it can be used to power ongoing scams and phishing attacks. 

If you run a publicly available website: Check with your hosting company or web developer to make sure the latest PHP security fixes have been applied. 

Can you get hacked from PHP2Shell? 

Not directly. The risk is for websites and servers that use PHP and haven’t installed the patch. However, this means that you can potentially be hacked if your personal information is leaked by an impacted company. 

How do you know if you’re at risk from the PHP “hack”?

Unfortunately, there’s no information yet on how many websites were hacked and what information may have been leaked due to the vulnerability. There’s also no single registry to track every small and independent online store affected by PHP server exploits. 

The safest bet: If you shop online, secure your accounts now and be extra vigilant with monitoring your accounts in the coming weeks.

How To Secure Your Online Accounts and Personal Information

The best thing you can do to protect yourself in the wake of the PHP vulnerability is proactively secure your accounts, monitor your financial statements, and be cautious when dealing with emails or other communication coming from impacted companies. 

1. Enable two-factor authentication (2FA) on all sensitive accounts. The PHP vulnerability can give hackers access to passwords, but not 2FA codes. Make sure you have 2FA enabled on your banking, email, and social media accounts, ideally using an authenticator app. 
2. Proactively update your passwords. Hackers use leaked passwords in “credential stuffing” attacks, attempting to gain access to accounts where you use the same login credentials. Ensure all online accounts use strong, unique passwords. You can use Aura’s password manager to generate, store, and monitor your login credentials. 
3. Beware of unexpected password reset or other security emails, calls, and texts. Data leaks can lead to ongoing phishing attacks. If you receive a suspicious email or call, don’t click on links or act in the moment. Instead, go directly to the impacted service’s website and log in using your usual method. 
4. Use “tokenized” payments (Apple Pay, Google Pay, etc.) when shopping online. Especially with smaller online stores, tools such as Apple Pay or PayPal use technology to keep your actual credit card number off merchant sites where it can be stolen. 
5. Monitor your financial statements. Keep an eye out for suspicious transactions or changes to your personal information on your credit accounts. Aura’s transaction and credit monitoring tools can alert you in near real-time to unexpected activity. 

For continuous monitoring of your financial accounts and personal information, plus device security, automatic data broker removal, and scam warnings, consider signing up for Aura's all-in-one online safety solution — free for 14 days.