Andorra Cybersecurity Agency Alerts on Critical PHP2Shell Flaws

The Agència Nacional de Ciberseguretat d'Andorra (ANC-AD) and its incident response team, CSIRT-AD, have issued an alert over two critical PHP vulnerabilities that could allow an attacker to take control of a web server without a username or password. The agency is urging every organisation in the country, whatever its size, to apply the patches immediately.

The disclosure follows the PHP development team's release of corrected versions on Wednesday. According to El Periòdic, the security fixes had been scheduled for 22 October, but technical details about the flaws became public before the patches were ready, and several international cybersecurity firms have already recorded exploitation attempts.

The ANC-AD characterises the potential reach as global, on a par with other mass-impact vulnerabilities seen in recent years. The flaws affect any PHP installation serving web pages regardless of configuration — including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — and all versions from PHP 5 onwards may be exposed. PHP 8.1 and earlier no longer receive official support, which sharpens the risk for systems that have not been kept current.

PHP underpins many widely used content management systems and e-commerce platforms, among them WordPress, Joomla, Drupal, PrestaShop, WooCommerce and Magento, as well as intranets, customer portals and bespoke applications.

The ANC-AD said the impact could be particularly significant for Andorra's business fabric, which is dominated by small and medium-sized companies. Many shops and establishments run PHP-based websites maintained by external providers or hosted on shared services, where the installed version is not always under their direct control. In larger organisations — financial entities, essential service operators and public administrations — the risk centres on customer portals, internal applications exposed to the internet and third-party platforms that could serve as an entry point to corporate networks. A single vulnerable platform at a hosting, managed services or development provider could affect several clients at once, the agency warned.

Its main recommendation is to update PHP without delay to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to apply the packages released by operating system distributors. It stressed that changing configuration alone is not enough. Organisations should review all systems using PHP, prioritise those exposed to the internet and contact their hosting or web maintenance provider where the server is not managed in-house. Systems that cannot be updated promptly should be isolated or temporarily disconnected.

The ANC-AD also asked operators to check for signs of compromise since 20 October, including new or modified PHP files, unknown administrator users, unusual processes or connections and anomalous access logs. Suspected incidents should be reported to CSIRT-AD, and any breach involving personal data must be notified to the Andorran Data Protection Agency within 72 hours of becoming aware of it. The agency said it is monitoring the incident in coordination with international counterparts and will update its guidance as new technical information emerges.