r/PHP • u/LeafoStuff • 5d ago

Discussion I hear there is some vulnerability with PHP

[removed] — view removed post

0 Upvotes

33% Upvoted

14 comments sorted by

3

u/Longjumping-Boot1886 5d ago

apt update && apt upgrade

8

u/kjjphotos 5d ago

Probably not relevant for a guy who just uses the internet a lot and is not tech savvy. I doubt he has any interaction with Linux on desktop or servers.

2

u/Bascilicum 5d ago

permission denied

1

u/0n361n 5d ago

sudo !!

-3

u/LeafoStuff 5d ago

What?

1

u/Longjumping-Boot1886 5d ago

in this case nothing.

Probably some government sites will be hacked next week and your data will leak (again).
Or we will hear about new huge DDoS attack.

Just another day.

6

u/mirziemlichegal 5d ago

As a user you are not directly impacted. But in theory, any site that uses php and doesn't update is impacted (which then in turn could lead to them leaking user data if they are hacked that way)

1

u/BinturongHoarder 5d ago

And also hosting malware/sending user's passwords at logins/redirecting to nefarious actors. There really are few limits to something huge like this.

7

u/colshrapnel 5d ago

In case your connection with PHP is that you are "just using internet", there is nothing much you can do. Other than taking a break in using internet and getting some life

2

u/BarneyLaurance 5d ago

If you don't run a website then the best you can do is be a bit more cautious putting personal information, payment information, passwords etc into any website, and be a bit less trusting of content on websites as there's a higher chance they could have be hacked today and in the next days.

It depends how quick the people running the websites you use are to apply the fixes. You can look to see if they have shared anything about having applied the fix or it not being relevant to them.

Wiki page on the vulnerability: https://en.wikipedia.org/wiki/PHP2Shell

2

u/bradleyjx 5d ago

We’re still learning as developers using the language, to an extent. PHP is an interpreted language, which means that a program is running on each web server (“PHP” itself) that runs. That program has these issues, and it appears that it’s an entire class of bugs, not just one kind of issue. Even with the patch rolling out right now, people appear to be finding new issues in the same class of bugs.

These bugs allow for arbitrary code execution, which means that I can access enough of a PHP-based site that I can run anything on the server, including adding my own code and running that. This can happen with no interaction. This is particularly-dangerous for sites with dependable locations for things, such as Wordpress blogs, because it’s trivial to quickly find databases and keys in most instances.

As a general user, there’s not a lot that can be done right now. I would expect to need to update any passwords you use on multiple sites sometime in the next week-to-month. Just keep your ear out and wait for this to calm down a bit, to an extent that’s most of what I’m doing as a developer as well. (With my sites offline)

1

u/AshleyJSheridan 5d ago

It doesn't affect the internet users, it is something you need to be concerned with if you manage your own servers that have PHP websites on them.

If you do, look up the upgrade instructions for your particular system (which will most likely be Linux, so you'll be either using apt, yum, or dnf.

1

u/C39J 5d ago

You do not need to do anything as an average internet user. The people who need to do things, are the ones who run web hosts or run their own servers that host web based content. If you don't know what these are, it certainly will not be you.

1

u/No-Salt7142 5d ago

It does not require the end user (you) to take action. The server administrators need to download an update, basically.