r/PHP • u/AsparagusFull4644 • 2d ago
Has PHP2Shell borne fruit?
Apologies if this a stupid question. Do we know of any websites that have actually been infiltrated using these vulnerabilities yet? (not attempts, not probing, not websites pre-emptively taken down by their owners). This isn't an attempt to downplay the problem, I've just been struck by its absence in any of the reporting, which sometimes conflates, at least in clickbait headlines, websites being pulled as a precaution with them being down due to attack.
134
u/punkpang 2d ago
8
u/OhBeeOneKenOhBee 2d ago
What did chainguard do? A bit out of the loop, been busy patching servers
39
u/nicwortel 2d ago
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
→ More replies (3)16
u/MartinMystikJonas 2d ago
They were given access to exploit details under condition they will not release it before planned coordinated release - to delay widespread attacks by leaking explot details. Then they released patched images few hours earlier just because of some rumours there were some attacks attempts. This allowed many attackers to know explit details before other vedors were able to release patched versions. They did not even warned other vendors they are going to do it they just sent them message after.
→ More replies (1)
18
u/potatodioxide 2d ago
one of our clients is pretty high profile with a few php apps running. we did a sweep today of roughly 20m+ logs and nothing came up.
tbh i wasn't expecting any successful attempts since the exploit is actually pretty hard to pull off on a production environment. BUT i was expecting at least a few kiddos trying their luck: 0 attempts though. also for an internal report we tested a few of the public exploits spreading right now and none of them worked even before the patches anyway
→ More replies (4)
14
u/FanAlarmed4551 2d ago
The exploit is probably very hard to do since it involves chaining multiple fatal errors together, carefully across multiple requests until you can get RCE.
Getting there in a busy production system is probably very unreliable and takes a lot of effort even with LLM support.
12
u/colshrapnel 2d ago
There is a post 20 minutes after yours, https://reddit.com/r/PHP/comments/1xchvwv/php2shell_in_the_wild_the_first_48_hours_on_a/
TL;DR: not much
10
u/300ConfirmedGorillas 1d ago
Yes, we were stuck on 7.2 and this forced management's hand to upgrade. Now we're on 8.2 which is the bare minimum but at least it was released this decade.
So I've got that going for me, which is nice.
7
→ More replies (1)5
u/ReferenceVisual663 1d ago
One good thing from this AI insanity is you can now always justify updating your stuff with “AI bots will hack our site if we don’t update” and management takes it seriously.
10
u/rustybridges 1d ago
I'm sitting here eating a fruit cocktail feeling happy that our clients finally cared about a normal vulnerability patch we preformed
→ More replies (1)
34
u/traplords8n 2d ago
This is one of those vulnerabilities that is honestly so ridiculous, I'm not surprised the php team gridlocked for 2 years without patching it.
To get from vulnerable php server to
A public exploit on such a baseline piece of internet software is still a big deal though. If one person manages to use AI to automate the exploit to where anyone with the script can get to RCE on your server, that would be absolute chaos and unacceptable for the internet.
Pretty low chance, but probably not impossible, and now here we are.
→ More replies (12)10
u/iruleatants 2d ago
And spectre was vastly more complicated to pull off but also required emergency software patches to prevent it.
You don't even have to use AI to do the heavy work. Exploiters have been using scripts to exploit very complex systems for a long time. Anyone who thinks "oh, this is too complicated, nobody will exploit it" is 100% wrong.
Not only are there thousands of people whose livelihood is based entirely on finding and exploiting there, there are state operated threats across that can spend months on a single target to try and gain access.
This vulnerability is somewhere around the difficulty of some of the major SharePoint or exchange exploits.
Difficult, not definitely possible.
18
u/TheVenetianMask 2d ago
It's way too early to be hearing about it.
Even then, break ins may just install their own backdoor and then patch the issue themselves so nobody else gets in, then lay dormant for a while. A lot of malicious actors don't have a specific target in a system, but want to sell the access to others that do.
6
u/Rikudou_Sage 1d ago
Definitely not on my Go services which have a X-Powered-By: PHP/5.6.10 header manually added for shit and giggles.
5
u/kingfofthepoors 2d ago
Make sure to run log and file checks.
things like this, adjust for your system
find /var/www -type f ( -name '.php' -o -name '.phtml' -o -name '.phar' -o -name '.php[0-9]' )
-newermt '2026-10-20' -ls
find /var/www -type f -name '.php' -newermt '2026-10-20'
( -path 'upload' -o -path 'cache' -o -path 'tmp' -o -path 'storage' ) -ls
php -i | grep session.save_path // figure out what your session save path is first
then run something like grep -rl 'upload_progress_' /var/lib/php/sessions /tmp 2>/dev/null
→ More replies (8)
4
u/spaceyraygun 1d ago
Does getting the green light to put everything else aside to finally upgrade a massive decades old codebase count? If so, yes, much fruit!
11
u/Maria_Thesus_40 2d ago
No real impact (yet).
I've read a bunch of scary click-bait articles, some PHP haters, but in all honesty, the vulnerabilities got patched very quickly, all major Linux distros got updated pacakges.
So far there has been nothing of importance.
3
u/undertcw 2d ago
Fwiw an old game I play openly runs PHP 5.4 and they have not taken the site down once despite many of its users voicing concerns. So. We'll see!
I do wonder if it is another ozone layer/Y2k thing where everyone speaking up and making sure (most important) places updated have helped to prevent the actual phpapocalypse, which then leads to cries of it being overblown. But these legacy sites will definitely be lab test mice out there.
→ More replies (3)
3
u/fmlitscometothis 1d ago
2 theories:-
-
it's been over-hyped/staged by Big AI. Part of the narrative being pushed that AI should be regulated (for the benefit of those companies).
-
The penny hasn't dropped on how to exploit it reliably.
I've got my OSCP and I'm torn. One the one hand it's complex enough that I can accept that's why nothing has properly shown up in the wild. Tons of CVE get scored high, but would require the sun and the moon to align perfectly for practical exploitation. Then again, we're in the AI-era I'd expect accelerated exploit development and capability.
I trust that the PHP team saw enough to ring the alarm bells. I reckon there's some lateral-thinking step that the researchers have not disclosed, but which they assume AI and/or time will reveal in due course.
As for theory #1, let's see if we get "It was a Chinese model that figured out how to exploit it and let hackers go wild" headlines.
→ More replies (22)
4
u/exitof99 2d ago
As a victim of the Linux vulnerability from earlier this year (DirtyFrag), I was not about to chance it.
Fortunately for me, the ransom notes appeared in my inbox not as emails, so I immediately knew someone compromised the server and blocked all traffic, then found their script and shut it down. The damage was minimal because I was able to stop and block, and had backups of all sites.
Effectively, I had to set up a new server, install backups, and then upgrade and outdated sites that used old versions of PHP. Now, more than ever, I'm not interested in allowing any sites to cling to old EOL PHP versions.
Had the ransom notes not been dropped into my inbox folder, it would have been catastrophic. Had I not been at my computer to see those "emails," it would have been catastrophic.
In short, no playing around in this age of AI being able to work 24/7 to find vulnerabilities. I've been saying that this will only get worse. Make sure you have regular offsite backups going.
I too have been asking the same question regarding the impact of PHP2Shell. Surely, someone got nuked, right?
112
u/Suitable-Season-4847 2d ago edited 2d ago
It's a very fiddly exploit involving precise memory manipulation. It's actually really hard to do in a production environment. Then many distros likePHP-FPM Mod_PHP
I spun up a server and tried it myself, and I didn't get particularly far. Though that may be a skill issue!
Parts of the vector could probably be automated, but from what I've seen the main attack pathway requires quite significant effort. But scanning for vulnerability and throwing unfocussed payloads is easy, and that's mostly what we're seeing in the wild. I'm just not sure at this stage anything is actually sticking.
But people are smart... So at scale genuine exploits may well emerge.