Two critical PHP flaws trigger global alert; millions of services face cyber risk

BENGALURU: Two critical PHP vulnerabilities that could allow hackers to remotely execute code on servers without authentication have triggered a cybersecurity alert, potentially exposing millions of internet-facing services. In a separate advisory, PHP also urged users to temporarily disable a file-upload tracking feature to mitigate another remote code execution risk, adding to concerns over the widely used programming language.PHP advised users on Oct 23 to temporarily disable its session upload progress feature until the next regular bugfix release. The warning followed an earlier advisory on Oct 21 about a related vulnerability. The latest issue affects applications only when specific session settings are changed while running and the upload progress feature remains enabled. Users who have already disabled the feature do not need to take further action.The broader concerns centre on two critical vulnerabilities collectively referred to as PHP2Shell.