A significant security flaw in PHP, a foundational language powering countless websites worldwide, has been leveraged by hackers to access internal server data and run remote commands. Although earlier incidents involving this vulnerability were documented, this marks the first verified instance of external attackers successfully breaching servers and executing commands. Amid a sharp rise in AI-powered cyberattacks and large-scale breaches this month, the cybersecurity community has labeled October as “Black October.
As reported by SecurityWeek, a U.S.-based cybersecurity news platform, on October 24, Adel Karimi, a security researcher at AI firm Perplexity, identified 35 cases of remote command execution exploiting the PHP vulnerability known as “PHP2Shell (Shell)” across three virtual servers he deployed. The attackers accessed these systems from two distinct IP addresses, triggered memory exhaustion, and extracted roughly 800KB of internal memory content. This data was subsequently used to issue direct instructions to the underlying operating system.
◇ Unauthorized server access without authentication… 50,000 attack attempts from 70 countries
The affected servers were not real operational systems but “honeypots”—deliberately vulnerable virtual environments set up by researchers to monitor and analyze hacking activities. The researcher maintained an unpatched PHP server online, running just one process to manage incoming attacks. In contrast, typical corporate servers distribute workloads across multiple processes, which significantly reduces the likelihood of reusing memory data stolen from a single breach in later attacks.
PHP2Shell refers to two distinct vulnerabilities in PHP’s handling of memory shortages. These flaws allow attackers to extract sensitive memory contents or execute remote commands without needing valid login credentials. If exploited on live corporate infrastructure, such attacks could result in customer data exposure, malware deployment, or unauthorized access to other connected systems. A security fix was issued by the PHP development team on October 21.
Despite the availability of the patch, the volume of attacks targeting PHP vulnerabilities continues to grow. According to SC Media, the Delft Threat Intelligence Research Institute in the Netherlands recorded over 50,000 PHP2Shell attack attempts originating from more than 600 IP addresses across 70 countries by October 26. At peak times, more than 5,100 requests were observed within a single hour. Still, these numbers reflect attempted intrusions, not confirmed successful breaches.
◇ AI-powered hacking endangers industrial systems… Escalating security crisis
AI-driven cyberattacks are also on the rise. A Microsoft report published on October 21 revealed that a hacking group linked to China employed an AI-based penetration testing tool to launch over 111,000 login attempts in a single day—October 11. In another incident, login requests reached up to 2,900 per minute, and several organizations lost cloud administrator-level access within just three hours.
The PHP2Shell vulnerability has also been identified in specific industrial machinery and factory management software. According to SecurityWeek, Siemens’ rugged network device “Ruggedcom APE1808,” Schneider Electric’s security management software, and certain components of ABB’s Manufacturing Execution System (MES) as well as B&R’s process control system were impacted.
Updating industrial systems is frequently delayed due to the necessity of verifying compatibility with ongoing production equipment. A security industry expert stated, “It’s essential to conduct immediate vulnerability assessments on internet-connected servers and industrial hardware, and to limit external access.
Leave a Reply