Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Source: Qualys Blog
At a glance
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level mitigation reduces exposure to the confirmed attack path without code changes, with or without an agent. WAF, IPS, and EDR protections from major vendors add further layers, and TruConfirm shows which hosts are actually reachable: 25 of 1,539 in one customer environment. Soon, Qualys ETM will factor these controls into risk scores. These controls buy time, but patching…