PHP RCE vulnerabilities discovered in multiple versions
Original title: I had plans for that second
Two unauthenticated RCE flaws in PHP affect all builds since 5.4, with exploitation attempts reported.
Two unauthenticated remote code execution flaws, dubbed php2shell, were found in PHP triggered by simple HTTP requests. The vulnerabilities affect every build since version 5.4. Talos assesses all industries running PHP applications as at risk. Older branches are end of life and will not receive patches. Cisco provides Snort signatures 67359 and 67360 for detection.
Unconfirmed: Exploitation attempts reported but full impact assessment pending.
- Flaws affect all PHP builds since 5.4
- Older branches are EOL
- Cisco Talos provides Snort rules
Impact: unauthenticated remote code execution
- 1.update to PHP 8.2 or later
- Organizations
- Cisco Talos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0c883b1d66afce606d9830f48d69d74b | 74c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1 MD5: 0c883b1d66afce606d9830f48d69d74b Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 485055033bcddfde56325c0d2feea4f2 | 2218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 MD5: 485055033bcddfde56325c0d2feea4f2 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | cca616647db9370c88998ae25da6997f | 6bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| sha256 | 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f | ample.exe Detection Name: W32.9F1F11A708-100.SBX.TG SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f MD5: cca616647db9370c88998ae25da6997f Talos Rep: https://ta |
| sha256 | 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 | 5da6997f.exe Detection Name: Win.Tool.Kmsauto::1201 SHA256: 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 MD5: 485055033bcddfde56325c0d2feea4f2 Talos Rep: https://ta |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta |
| sha256 | d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1 | 2feea4f2.exe Detection Name: Win.Tool.Kmsauto::1201 SHA256: d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1 MD5: 0c883b1d66afce606d9830f48d69d74b Talos Rep: https://ta |
From the original article
5 min read at blog.talosintelligence.com
The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.
By Hazel Burton · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.