Even after PHP2Shell, blast radius matters more than a CVSS score

Two decade-old PHP remote code execution flaws, dubbed PHP2Shell, were discovered by researchers at Calif and Wiz using AI assistance and disclosed jointly with OpenAI, but attackers were already probing them before the official fix arrived on October 21. Amazon detected exploitation attempts four days ahead of disclosure, watchTowr and Cloudflare logged a surge of attacks right after the patch shipped, and CISA added both CVEs to its known-exploited list on October 26. Despite the available update, Censys found roughly 32.5 million internet-facing PHP instances still running vulnerable versions and over 60 million more with no reported version, partly because PHP 8.1 and earlier no longer receive official builds and many appliances can't be patched directly by their owners. The piece argues that since remediation (taking weeks on average, per Verizon's DBIR and Qualys data) will keep lagging behind exploitation, organizations should pair patching with strict control over service accounts, API keys, and cloud credentials, since the real damage from a breach often comes from what a compromised identity can reach next, as seen in the related LiteLLM leaked-key incident.