NEW YORK — Pharmacy retailers and other businesses running PHP-based websites face renewed pressure to secure their systems after Amazon reported attempts to exploit two critical vulnerabilities, including activity detected before the flaws were publicly disclosed.
The vulnerabilities, collectively known as PHP2Shell, could allow attackers to execute malicious code on an affected server without logging in. Both have critical severity ratings of 9.2 out of 10. PHP is software that processes requests and powers website functions behind the scenes, so the underlying server technology matters even for businesses that outsource website management.
Thorvardur de Shong
Amazon Threat Intelligence said its MadPot network, which uses decoy systems to detect malicious activity, recorded an exploitation attempt on October 17. Additional attempts followed before security patches became available on October 21, with further activity appearing almost immediately after their release. Amazon cautioned that it was unclear whether the attempts would have succeeded against real-world systems.
Reports of attempted exploitation should be distinguished from confirmed breaches. In an October 25 update, Palo Alto Networks’ Unit 42 retracted an earlier assessment that linked an attack on a European government agency to PHP2Shell. Researchers said they could not confirm that the two vulnerabilities provided the attackers’ initial access. The company continued to recommend immediate patching.
PHP developers released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Businesses using older branches should consult their hosting provider or software vendor for patched packages or a supported upgrade. Temporary configuration changes do not fully resolve both vulnerabilities.
Pharmaceutical companies have also taken precautionary action. Japanese drugmaker Shionogi said in an October 26 notice that it had temporarily suspended its Actair e-learning and registered physician verification services beginning October 21, followed by lecture reservation and viewing pages on October 23. The company said it was investigating the potential impact of the PHP vulnerabilities and completing necessary fixes and safety checks. Japanese pharmaceutical and supplement maker Wakunaga Pharmaceutical said on October 23 that it had restored its website after temporarily suspending access to address the vulnerabilities. Neither notice described a confirmed breach.
Separately, pharmaceutical consulting and technology business tiger.PHARMA said it updated its PHP-based systems on October 22, including online shops, relevant components of its pharmadata360.eu platform, and systems that host customer applications.eu platform, and systems that host customer applications.eu platform, and systems that host customer applications. The company emphasized that patching the vulnerabilities is part of ongoing security maintenance and requires continued monitoring and other safeguards.
For pharmacy operators, a practical first step is to ask their website or hosting provider to confirm that the PHP software powering their site has been patched. Updating a content management system alone does not address the underlying issue. WordPress said the vulnerabilities are not specific to its platform and that no WordPress update is required or planned to fix them.
Businesses can check their PHP version in WordPress under Tools > Site Health > Info> Server. Hosting providers may also display this information in their admin panels. WordPress urged site owners to verify their providers’ response rather than assume they had already completed protective measures.
Additional guidance followed the initial patches. On October 23, PHP developers identified a separate, uncommon route to remote code execution involving specific session settings and application behavior. They advised affected operators to disable session upload progress until a regular bugfix release. On October 26, the team also issued updated Windows packages addressing a separate vulnerability in the bundled Brotli compression library.
Amazon recommended reviewing server logs, unexpected file changes, and unusual program activity, with investigations extending back to at least October 17. For retailers, confirming the update is only part of the response: technical teams should also assess whether suspicious activity occurred before protection was in place.
Submit Your Press Release
Have news to share? Send us your press releases and announcements.
Send Press Release
