PHP2Shell, One Week On: Exploited, Hidden Inside Appliances, and Why Outside Scans Missed It
A week after the critical PHP flaws were fixed, CISA confirms exploitation, Palo Alto Networks reports attacks on firewall management interfaces running PHP inside, and a public contest was won within hours. Attack surface management tools could not tell operators where PHP was running. What it came down to was asset management, including SBOMs.