SANS drops Infocon to green after coordinated PHP patches
Original title: PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
No reliable public exploit is known, though firms claim private code and scanners report many attempts.
SANS returned Infocon to green after vendors shipped PHP patches alongside PHP.net. Johannes Ullrich says coordinated disclosure produced timely fixes, despite an early leak. No reliable public exploit is known; some firms claim private working code, and partial exploits have appeared, including possibly malicious ones. Cloudflare and Amazon report many attempts whose success is unclear. Patching is described as the only reliable defense.
Unconfirmed: It is not clear whether the exploit attempts seen by Cloudflare and Amazon are working exploits.
- Infocon was lowered to green on the morning of October 23.
- Workarounds and web application firewall rules are not considered fully effective.
- Unpatched embedded devices and appliances should be isolated.
- Ullrich also flags Node.js and Fortinet issues from the same week.
Impact: PHP applications at risk if left unpatched
| Product | Affected |
|---|---|
| PHP | — |
- 1.Apply the vendor or PHP.net patch.
- 2.Isolate PHP applications that cannot be upgraded.
- 3.Avoid running untrusted partial exploit code, which may be malicious.
- Products
- PHP
- Organizations
- CloudflareAmazonPHP.net
From the original article
2 min read at isc.sans.eduThis morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.