We put together a special Wednesday CyberCall after two critical PHP vulnerabilities, known as php2shell, leaked a day before their planned disclosure. John Hammond of Huntress and John Strand of Black Hills Information Security joined me to talk through what happened and what MSPs should be doing about it.

John Hammond explained why a flaw in PHP itself matters so much. It sits underneath WordPress, Drupal, Joomla, Magento, and many other platforms, and it can lead to full remote code execution on the server. He also shared why he took his own WordPress site offline until the patch was released. John Strand walked through the exposure numbers, with more than 230,000 internet-facing servers on PHP 7.x, 8.0, and 8.1 alone. He also explained how AI has shortened the time between a patch and a working exploit.

We also covered:

• Whether coordinated disclosure still works when leaks happen this easily
• Why “the website isn’t our responsibility” won’t hold up when a client gets breached
• How to explain the risk to business owners in terms they care about
• What to do with clients stuck on older PHP versions that won’t get a patch
• Why you shouldn’t run the early proof of concept code that’s circulating online

If your clients have websites, ecommerce stores, or any software that runs on PHP, this is worth a listen before the end of the week.