PHP2Shell flaws are under active attack after details leaked online. PHP issued emergency fixes; administrators should patch exposed servers immediately.