Threat Research from Sumrite.

Analysis of vulnerability classes and attack techniques that matter to SaaS and enterprise teams, with detection and prevention advice.

Code editor showing PHP application source code, representing servers affected by the PHP2Shell vulnerabilities

Threat Research

PHP2Shell: two critical PHP flaws allow unauthenticated RCE. What is affected and how to patch, from Sumrite.

Two CVSS 9.2 memory-safety bugs in the PHP engine allow unauthenticated remote code execution. Fixed versions, who is most exposed and what to do before you can patch.

By Niyaz Khan21 October 20267 min read

Talk to a tester

Want us to look at your application?

Scoped quote within a day. Expert-led testing, verified findings, a fix-and-retest cycle and a report your auditors can use as evidence.

Get a quote Explore services