PHP2Shell patches are out; exploit attempts seen, no confirmed hits
Original title: We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue
Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.
On The Register’s Kettle podcast, editors recapped PHP2Shell, memory-safety flaws in PHP core that can lead to remote code execution, site takeover, or data theft. Jessica Lyons said one or both issues affect releases over about the last decade, back to about version 5.4, and roughly 70% of websites. The PHP Foundation issued emergency patches on Wednesday after weekend leaks. AWS later said it saw exploitation attempts at least four days before the patches; as of Friday, Lyons said experts had not confirmed a successful attack.
Unconfirmed: AWS reported exploitation attempts, but the PHP Foundation and experts had not confirmed successful attacks as of Friday.
- A third related issue was being discussed by the day of the podcast.
- Coordinated disclosure began after an independent researcher found a flaw in August.
- Legacy servers without an update path remain exposed unless rebuilt.
- Public proofs of concept exist; some work and some do not.
- Final Fantasy XIV’s login servers were among services taken offline.
Impact: remote code execution, site takeover, or data theft
| Product | Affected |
|---|---|
| PHP | releases over about the last decade, back to about version 5.4 |
- 1.Install the PHP Foundation emergency patches on versions that can be updated.
- 2.Rebuild or take offline legacy PHP servers that have no update path.
- Products
- PHP
- Organizations
- PHP FoundationAWS
From the original article
16 min read at theregister.comWhat better way to celebrate Cybersecurity Awareness Month than warning that three-quarters of the web is about to be set on fire?
By Brandon Vigliarolo · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.