Study Finds Hundreds of Mobile Apps Communicating with Potentially Vulnerable PHP Servers

A recent investigation has uncovered that 426 Android and iOS applications are connecting to web servers that advertise PHP versions susceptible to the PHP2Shell back‑door exploit. The finding, initially reported by cybersecurity outlet HackRead, highlights a widespread exposure that could allow attackers to execute arbitrary code on affected sites and, by extension, compromise data transmitted by the apps.

The research team scanned the network traffic of publicly available mobile apps and identified connections to servers running PHP 5.3 through 7.2, versions known to be vulnerable to PHP2Shell when improperly configured. While the apps themselves do not contain malicious code, their reliance on external APIs and content delivery endpoints means that a compromised server could serve malicious payloads to end users without their knowledge.

PHP2Shell is a web‑shell that leverages insecure PHP installations to grant attackers remote command execution capabilities. Disclosed in early 2023, the vulnerability gained attention after several high‑profile breaches of e‑commerce and content platforms. Security experts warn that any service exposing an outdated PHP interpreter without the necessary hardening measures can become a gateway for attackers to infiltrate downstream applications.

Industry analysts note that the issue is not limited to a single category of apps; the compromised servers were found behind a mix of gaming, productivity, and utility applications. This breadth underscores a systemic risk in the mobile ecosystem, where developers often outsource backend services to third‑party providers. When those providers lag in patch management, the security posture of all dependent apps deteriorates.

To mitigate the threat, the researchers recommend that app developers audit the software stacks of any third‑party services they consume, enforce regular updates of server‑side components, and implement strict input validation on data exchanged with external APIs. End users are advised to keep their devices and applications up to date and to monitor permissions granted to apps that handle sensitive information. As the mobile market continues to expand, the study serves as a reminder that security must be addressed holistically, spanning both client‑side code and the server environments that support it.