We observed 450+ IPs exploiting PHP2Shell within the first 24 hours.
Upgrading PHP is the fix, but when you can upgrade depends on your version:
→ 8.2 to 8.5: a full official release is out. Upgrade today.
→ 7.4 to 8.1: only minimal source backports. Build from source, or wait on your distro or LTS vendor.
→ 5.4 to 7.3: nothing from the PHP project. A vendor backport or a major upgrade.
Put together, roughly 48% of PHP sites have no full release to upgrade to (W3Techs data).
For that wait, we broke down how the two free CrowdSec WAF rules work: https://www.crowdsec.net/blog/php2shell-virtual-patching?utm_source=mastodon&utm_medium=social&utm_campaign=php2shell