PHP Sounds the Alarm on Critical Vulnerability Affecting Millions
Last week, the PHP Foundation released emergency security updates that patched two critical vulnerabilities, collectively nicknamed “PHP2shell,” in the widely used programming language that powers much of the internet.
This vulnerability could affect millions of devices, and exploitation has already begun.
Here’s what you need to know.
What Businesses Need to Do to Protect Themselves
Following CISA guidelines, businesses must:
- Identify and inventory systems that run PHP across your organization.
- Apply the PHP patch immediately, prioritizing internet-facing systems.
- Take offline systems that cannot be updated immediately or that run PHP 8.1 or earlier until they can be patched or updated.
- Set up web application firewalls for added protection.
- Monitor for suspicious activity.
It is important to remain on high alert over these next few weeks, especially regarding your internet-facing devices.
What Is PHP?
Created in the 1990s, PHP is a fundamental scripting language used by just under 70% of all websites. Several major websites such as WordPress, Facebook, Wikipedia, Etsy, and many more are built on this technology.
A vulnerability at this scale has the potential to impact millions of systems.
How The “PHP2Shell” Exploitation Works (Simplified)
For those interested in how this whole thing works from a technical standpoint, here’s a simple breakdown:
When you go to a website, PHP helps build the webpage you visit. It uses memory to keep track of what it’s doing, and when it’s done, it cleans up after itself before the next request.
But these vulnerabilities cause that cleanup process to malfunction, leaving PHP’s memory in a broken state. A hacker can then send a specially designed request that takes advantage of this malfunction, tricking PHP into running the hacker’s own commands on the computer hosting the website.
Think of it like a robot working in a warehouse. They work through a list of instructions given to them, telling them where items go and what needs to be moved. But the worker suddenly gets confused about how to follow those instructions.
A hacker can then take advantage of that confusion by sending their own instructions that trick the robot into doing something it shouldn’t. Maybe instead of putting a pallet in the lumber yard, for example, the robot might be told to leave it out in the parking lot. Or maybe it’s told to do something much worse, like break into the manager’s office and steal sensitive data.
In the same way, a hacker can exploit PHP’s vulnerabilities to trick the program into running their own command on the computer hosting the website. This could allow the attacker to access sensitive data such as passwords and authentication tokens. And again, this could potentially happen on nearly 70% of the entire world’s websites.
And Amazon Web Services (AWS) has already confirmed that hackers have begun scanning for this vulnerability to begin exploitation. This is expected to increase throughout the coming weeks. It is such a serious issue that the PHP Foundation has ranked these vulnerabilities a 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS) – a critical threat.
The AI-Powered Cyberthreat
These vulnerabilities aren’t new. The same root vulnerability was discovered by engineer Mihail Krov, then an engineer at Quarkslab, two years ago. While the PHP Foundation knew about this flaw, an alert was never rolled out, as addressed in a blog post last Wednesday.
What’s changed today, however, is the pervasiveness of AI and the speed at which attackers can use these new tools to detect and exploit vulnerabilities. Now, this vulnerability, which may have taken attackers weeks or months to exploit, can potentially take a matter of hours.
The 20 MSP Is Here to Help
This is a scary time right now, and we’re here for you. If you have any questions or concerns, please do not hesitate to contact us.
The 20 MSP is available 24/7/365 for exactly these reasons. We can help monitor your systems and make sure you receive the proper PHP updates to protect your business.
Stay safe, The 20 MSP.
