On October 21, PHP developers released patches for two critical vulnerabilities collectively known as PHP2Shell. These flaws could allow attackers to execute code on a server without authorization and gain access to sensitive data.

Which CMS are affected

Wiz researchers demonstrated attacks on WordPress, Drupal, and Joomla. There is also potential risk for other PHP-based projects, including 1C-Bitrix, custom landing pages, and pre-landers if they are running a vulnerable version.

The vulnerabilities are in PHP itself, which executes the site’s code on the server. Updating the CMS and plugins does not fix them.

How to patch the vulnerabilities

You need to update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or install a patched package from your server software provider. If your site is hosted, ask support to confirm that patches have been applied to your project.

Will neural networks make it easier to hack competitors’ sites in affiliate marketing?

In iGaming SEO, the battle for rankings has long gone beyond search optimization: abuses, complaints, and hacking of competitors’ resources are common. PHP vulnerabilities give attackers extra opportunities—to steal data, swap affiliate links, or redirect visitors. The site may keep running, but the traffic could start generating revenue for someone else.

According to Wiz, AI helped develop and adapt working attacks for several applications within hours. As models advance, exploiting complex bugs could become faster and more accessible. For webmasters, this raises the cost of delaying patches: at stake are data, ad budgets, and revenue from already acquired audiences.