It was inspiring to watch the behind-the-scenes¹ of the industry coming together, weeks in advance, to protect the world's infrastructure and mitigate php2shell. We deployed Vercel WAF mitigations that have already successfully prevented attempts on PHP origins. Assume more vulnerabilities are on the way. Flex the patch → redeploy muscle. ¹ A Slack channel. Thank you @SlackHQ!

Vercel Developers@vercel_dev3d ago

php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+. Public exploits are out. Vercel WAF rules were shipped before disclosure and have been blocking known exploit patterns. Patch PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. https://t.co/rpQBwg1JTm