PHP2Shell: Exploitation Attempts and Remediation Trends | Wiz Blog
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure. This post summarizes what we have observed in terms of remediation efforts and exploitation attempts across real world environments and in our own honeypot data to date and shares findings from our ongoing investigation into these activities. We will continue monitoring developments and update this post as new evidence emerges. During this period, the number of significantly affected organizations - defined here as those with at least one exposed and vulnerable instance - fell by approximately 47.9% (see graph below). For reference, our data shows that PHP itself is in use by 65% of organizations in our dataset. We have so far observed the following types of…