When attackers compromise legitimate websites, the danger doesn't stop at the web server. Those same websites can become vehicles for phishing, malware, and other attacks targeting unsuspecting visitors.
That's the risk highlighted by two recently disclosed critical vulnerabilities in PHP, the server-side programming language powering much of the web. Known as PHP2Shell, these vulnerabilities could allow unauthenticated attackers to execute malicious code on vulnerable web servers, potentially giving them control over legitimate websites.
And the threat is already real. Recent industry reports1 say attackers began attempting to exploit PHP2Shell on October 17, four days before the vulnerabilities were publicly disclosed. Researchers have since confirmed successful remote code execution against vulnerable PHP installations in honeypot environments, and CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
From Compromised Servers to Browser-Based Attacks
These attacks can take several forms:
- Credential theft: Injected phishing forms or redirects to fraudulent authentication pages.
- ClickFix attacks: Malicious instructions that trick users into executing commands to install malware.
- Financial data theft: JavaScript skimmers designed to capture payment card information.
- Malicious downloads: Compromised websites delivering scripts or malware.
- Malicious script injection: Hidden scripts and techniques such as EtherHiding that retrieve malicious payloads.
These attacks are particularly dangerous because users may be visiting familiar, previously trusted websites. The domain may have an established reputation, even though the content being delivered has been weaponized.
Prisma Browser Detects the Threat, Not the Technology
For Prisma Browser customers, protection against malicious content delivered through compromised websites isn't new. Advanced Web Protection has been available in Prisma Browser since October 2025, a full year before PHP2Shell was disclosed. It continuously scans webpages and their components in real time to detect and block malicious content, including obfuscated code, injected scripts, and other web-based threats.
For enterprises, the question isn't only whether their own web infrastructure is vulnerable. It's also what happens when employees visit a legitimate website that attackers have compromised. That's where browser security becomes critical.
Unlike approaches that rely on identifying the technology powering a website, Prisma Browser's protection is content-based, not technology-based. It works regardless of what the web server runs.
This distinction is critical. Some security solutions attempt to apply security policies based on whether PHP is being used to power the website, but this is too broad since the vast majority of the web is powered by PHP. This is like flagging every email written in English because most phishing emails are in English. This approach does not work in actually identifying if a specific page is serving malicious content and can slow down business.
In fact, we've seen this protection in action in live customer environments this month, with detections ranging from credit card skimmers and ClickFix attacks to malicious script injections.
Already Detecting and Blocking Compromised Sites: Real Examples from This Month
Over the past couple weeks alone, Advanced Web Protection has caught compromised PHP sites that contained credit card skimmers, script droppers, ClickFix attacks, malicious script injections, and EtherHiding injections. For detailed examples, you can check these recent posts on X:
These real-world detections illustrate the range of attacks that compromised websites can deliver, from financial data theft to malware installation and social engineering.
Compromised PHP and WordPress websites are a recurring source of malicious activity detected by Advanced Web Protection. While these examples have not been attributed specifically to PHP2Shell exploitation, they demonstrate that Prisma Browser is already protecting customers against the downstream threats that compromised websites can introduce.
We're not waiting for the next vulnerability to become an active attack. We're already detecting and blocking malicious content delivered through compromised websites.
The Bigger Lesson: Protection Is On the Server Side And On The User End
PHP2Shell reinforces an important security principle. The attack landscape changes constantly driving the need for a strong multi-layered security strategy. Enterprises must invest time and resources now to identify exposure, remediate vulnerabilities, investigate compromises, and protect users from the threats they encounter online.
Website administrators must address server-side vulnerabilities through appropriate patching and remediation. But organizations also need to protect employees from malicious content delivered through websites they don't own or control.
Prisma Browser and Advanced Web Protection provide defense inside the browser, where a compromised website meets your users, because a trusted website doesn't always serve trusted content.
To learn more about how Prisma Browser detects and blocks PHP exploits and other web threats, see Advanced Web Protection in action.