PHP 維護者為 PHP2Shell 兩項嚴重漏洞發佈修補程式

Critical PHP vulnerabilities send organizations scrambling to secure their systems

The maintainers of the PHP programming language today released patches for two critical vulnerabilities that affect up to 70% of the world’s websites.

Several cybersecurity agencies including the National Security Agency are urging organizations to shut down affected systems while they implement the updates. Many municipalities, schools and private companies have taken their advice. Content delivery network operators Cloudflare Inc. and Fastly Inc., meanwhile, reported that hackers are already trying to exploit the bugs. 

“This is not a theoretical vulnerability,” said Fastly Chief Product Officer Kelly Shortridge. “We observe many billions of PHP requests a day across Fastly’s global network, and we are seeing evidence of active attacks.”

The two exploits are together known as PHP2Shell. They enable hackers to deploy malicious code on vulnerable servers. The installation process takes only a few seconds in some cases. Once the malware compromises a website, it can read its database and launch cyberattacks against visitors.

The first PHP2Shell exploit emerges when a piece of PHP code receives more data than it can process. PHP responds to such situations by deleting some of the ingested data. According to the language’s maintainers, the data left over after that operation can be used by hackers to launch cyberattacks.

The second PHP2Shell exploit relates to global state, information that is shared by multiple components of a program. Each piece of global state is associated with a specific request to a PHP application. When the application processes a request, it deletes the associated global state. PHP2Shell enables malicious code to access some of that data before it’s deleted, which opens the door to cyberattacks.

“This is about as broad as a critical vulnerability gets,” said Moshe Siman Tov Bustan, a cybersecurity research team lead at application security startup OX Security Inc. “If you have a publicly accessible PHP instance and haven’t patched it, start from the assumption that you’re exposed. If you find evidence of exploitation, assume compromise, not just exposure.”

The underlying technical issue behind PHP2Shell has been present in PHP for decades. However, researchers believed that it can’t be exploited in practice. That changed in August, when an employee of cybersecurity company Calif.io Inc. used GPT-5.6 Sol to scan PHP’s code base for bugs. The audit, which was financed by OpenAI Group PBC, revealed that PHP2Shell can be targeted after all.

Google LLC’s Wiz cybersecurity unit made a number of additional discoveries about the issue shortly thereafter. Over the following weeks, tech firms and cybersecurity researchers formed an industry group to tackle PHP2Shell. The effort reportedly produced more than 10,000 lines of code and fixes spanning over 20 PHP files.

The consortium originally planned to release the patch on Thursday, but the vulnerability was leaked yesterday on a popular developer forum. That led PHP’s maintainers to rush out the fixes today. 

“A leaked embargo is a leadership test as much as a technical one, because the decisions that matter today get made before anyone has full details,” said Andrew Obadiaru, chief information security officer of cybersecurity company Cobalt Inc. “Security leaders need to be able to answer a few questions quickly: where PHP is running, who owns each of those systems, and who has the authority to take something offline if it can’t be patched.”

“PHP has been embedded in websites, applications and third-party software for decades, and many organizations are still running older versions that no longer receive standard security updates. For those systems, ‘Drop everything and patch’ isn’t always an option,” explained Itai Goldman, co-founder and chief technology officer of vulnerability mitigation startup Miggo Ltd. “Security teams need to identify their exposure now, prioritize internet-facing systems and work with vendors on upgrade paths or supported fixes.”

Cloudflare has updated its CDN to shield customer websites from PHP2Shell cyberattacks. However, the company stressed that users should still patch their systems. CrowdStrike Holdings Inc. and several other enterprise cybersecurity providers have also added mitigations to their products. OpenAI, for its part, released a tool that can help users of its Codex coding assistant find vulnerable PHP installations in their systems.

Image: Pixabay

A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

• 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
• 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network

SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.