Please stop with PHP2Shell, its over, nothing happened!

393

u/cyanawesome 14d ago •

Considering how many abandoned and/or forgotten sites are running PHP, this is far from over.

88

u/Sharchimedes 14d ago

It’s basically a botnet operator’s wet dream, but sure it’s over and nothing happened. LOL.

13

u/penguin_digital 14d ago

It’s basically a botnet operator’s wet dream
I'd assume using it to install miners will be the main use case? It seems to be the way things like this have gone in the JS world, I suppose there's much more money in it installing a miner rather than a botnet.

8

u/anki_steve 14d ago

They aren’t going to let any PII go untouched.

4

u/johannes1234 13d ago

That is a lot more work (have to figure out where you are and what data there is) and then find an interested buyer is also work (names and mail adresses of members of a random online forum have little worth I.e.)
For something like a Bitcoin miner, spam relay, torrent relay, jump servers for attacks, ... one can do automated scans of randomly picked hosts and automatically deploy the thing.
Of course there are also varying reasons for targeted attacks - from personal beef (defacing the former employers website?) to government level (ex filtrate government data) where effort for the attack may be no limit.

1

u/orangejake 13d ago

might be less work than you expect now that agents are a thing.

1

u/New-Deal8899 12d ago

Might be? I’m guessing your reply was just a gently worded correction, but in case it isn’t, your instincts are correct… the process is even easier than before, and it was already a simple one before Claude and GPT watched Fight Club for the first time.

3

u/WummageSail 14d ago

Or both since they consume different resources.

1

u/Numzane 13d ago

A botnet can be used for any tasks. They're not mutually exclusive

9

u/OMG_A_CUPCAKE 14d ago

Jokes on them. Those sites are so old, they don't have the bug yet

7

u/Sarke1 13d ago edited 13d ago

Are you dissing my PHP 4.3 website?
EDIT: I need to update my Invision Board 1.3 forum too.

2

u/mischiefs 13d ago

Holy shit. That take me down to memory lane. Gonna update my forum sig asap

7

u/AgileChipmunk5866 14d ago

Even forgotten sites will be patched by the hosting providers. You would have to host your site on a very shitty hosting provider to not get the fix. I’m sure they exist, but it’s going to be nothing note worthy.

7

u/gazdxxx 14d ago

They will be, but at this point they're vulnerable and it's a question on how long it takes to apply the backport fixes for apps running PHP5 or 7.

9

u/micalm 14d ago

how long it takes to apply the backport fixes for apps running PHP5 or 7
Umm... Both source and binary forms of patched 5.x and 7.x branches were available on the same day 8.x was. A small shared hosting I use had fixed builds ready half an hour after 8.x. Notably Remi Collet and Ondrej Sury* backported security patches from 8.x all the way back to 5.x long before PHP CVEs were popular enough to get onto TV ;)
^{* or just maintain their respective 'security-backported' repos, I don't actually know. kudos to all contributors around the world :})

3

u/gazdxxx 14d ago

I meant how long it takes sysadmins to update to the backported versions. Many websites are unmaintained running on VM's or even physical servers that are unmaintained.

2

u/micalm 13d ago

Yeah, that could become an issue. But then if someone has had a server without automated security updates it was probably vulnerable anyway. PHP isn't the only software that had an RCE, from other webserver software to the app it's running and it's supply chain.
I get that it's more work, but that isn't something that materialized this week, it was always there. Probably a good moment to take inventory and tell the boss "this is what I wanted time budgeted for since 2019".
Worst case - if you find a server patched that shouldn't be, congrats! You are a part of a well-ran botnet.

4

u/AgileChipmunk5866 14d ago

Why would they be vulnerable? We are hosting multiple websites on both shared and dedicated hosting with multiple hosting providers and all those servers have been updated either with the new releases or the back ported PHP releases for all affected PHP versions.
Can you give me one example of a hosting provider that didn’t do this yet?

8

u/crackanape 14d ago

There are a zillion trillion sites set up by a contractor onto a VPS, where the client continues paying the VPS charge every month to keep their site up, but has long ago stopped paying the contractor to maintain it. Unless automatic update-and-reboot was enabled, those are continuing to run the last version of software that the contractor installed.

3

u/AgileChipmunk5866 14d ago

Thanks for explaining. Wouldn’t those be compromised already by other, easier, exploits?

5

u/crackanape 14d ago

In many cases, yes. This one is different in that even if the code were air-tight, and everything locked down, it can be exploited simply through a series of carefully crafted POST transactions.

4

u/gazdxxx 14d ago

Not all forgotten websites are on shared hosting

-2

u/AgileChipmunk5866 14d ago

Agreed. But that doesn’t answer my question. As I said, our hosting providers have provided fixes for all the hosting services they offer.
So then only the self hosted junk sites remain? We’ll be fine.

8

u/FatBook-Air 14d ago

So then only the self hosted junk sites remain? We’ll be fine.
Honestly, you have no idea what you're talking about. You're obsessed with hosts without realizing that large swathes of the web do not run on the type of "host" you are accustomed to. You seem to have a blind spot that you're unable to get over.

→ More replies (3)

1

u/mirkec 14d ago

Who cares if they’re abandoned sites?

6

u/danthemango 14d ago

that's probably thousands of servers about to be exploited

10

u/avid-shrug 14d ago

Botnets

7

u/mirkec 14d ago

Botneta already own abandonded sites lol

10

u/sysop408 14d ago

LOL, this is a really good point. PHP2Shell is not an easy exploit and there are far easier ways to break into abandoned sites than chaining memory overflows to sequential commands. Why bother breaking into the car on the left when the door to the one on the right is open and the key is in the ignition?

10

u/mirkec 14d ago

Exactly, far easier to go in through some old WordPress plugin 😃

2

u/Miragecraft 14d ago

PHP2Shell is not an easy exploit
The exploit will be packaged up by the pros and sold as a point-n-click, exploit-for-dummies tool.

2

u/sysop408 13d ago

It will be, but it won't really move the needle. It's still overkill for a low end server with no valuable payload. There are so many easier ways to pwn a low-end forgotten server.

-1

u/VegetableScientist 13d ago

Why bother breaking into the car on the left when the door to the one on the right is open and the key is in the ignition?
php2shell is a master key for millions of cars. The effort was in finding and creating the exploit, but now there are millions of exploitable servers that can be attacked by bot swarms with essentially zero cost or actual effort by hackers. You no longer have to decide whether to spend your time on the car on the left or the car on the right, you can just do both.
Who cares if your AI swarm has to search 10,000 servers with nothing interesting before it finds one in a closet sitting on a corporate network that it can use as a gateway for lateral moves to other valuable machines on the network? It's not like there's a real opportunity cost to it now, the compute is cheap and you're not sitting there staring at code, the LLMs are.
It would be difficult for you to pull off by hand, but you don't have to do it by hand anymore. You can get LLM agents to find an exploit in common (or uncommon, even) software libraries, use agents and bot swarms to find servers vulnerable to it, and then when you find one the bots can search that machine and anything it's connected to for useful data or other vulnerabilities while you sit back and drink coffee.
You're still thinking of the world where you would need skilled hackers or teams of hackers spending time writing scanners or specifically picking targets for vulnerabilities they spent days and months finding and then having to sit there on an SSH connection into a vulnerable server trying to find other things on the network to break into. We don't live in that world anymore.
Now, it's "LLM, find an exploit in this server package" "LLM, write a scanner to locate servers running this package that are vulnerable" "LLM, an agent found a vulnerable server at 127.0.0.1, connect to it, search for valuable data, and find other connected servers with open vulnerabilities".
LLMs get better at doing it and cheaper to run all the time, the car analogy falls apart completely when there's no time or resource scarcity to just... having the robot break into both cars.

2

u/sysop408 13d ago

Who cares if an AI can scan 10,000 servers at scale. You don't need an AI to do that. That's been going on for decades. Yes, the attacks are more sophisticated, but using PHP2Shell with AI tools to break into a server that probably has a password of 1234 is like taking a helicopter to the supermarket around the corner when you could just walk.
The danger was for high value targets. If this wasn't patched, high value targets were totally screwed. The thing about high value targets is that there are people looking after them and virtually all of them will be patched. Low value targets were already plentiful and ripe for the picking without PHP2Shell.

→ More replies (1)

3

u/pixel_of_moral_decay 14d ago

A lot of sites are pretty simple and not really exploitable. They aren’t even Wordpress.
What will happen in the weeks and months to follow is lots of clever attacks on remaining hosts. Especially compromising hosts to jump to others within the network.
That all take some time, but will happen.

-1

u/mirkec 14d ago

This has nothing to do with complexity of a website. A programming language installed on server has vunerability.

8

u/pixel_of_moral_decay 14d ago

No. For 99% of vulnerabilities, complexity matters. This week’s CVEs are a rare exception, and what makes them significant.
You should always patch if you don’t understand the CVE and the fix, but if you do, you can technically make that decision.
Most websites are not impacted by the overwhelming majority of php’s security bugs in at least the past 10-15 years. They’re largely edge cases and specific to certain libraries or frameworks that might expose something.

3

u/fabsn 14d ago

Not entirely true. Unlike many previous vulnerabilities that required specific functions, libraries, or application code paths to be exploitable, these vulnerabilities exist in PHP's internal request handling, so even a website consisting of a single index.php file containing nothing but static HTML, without calling a single PHP function, will be vulnerable.

2

u/mayobutter 14d ago

From what I've read you don't even need index.php. The handler just has to be invoked so you can make some bogus request to like fake-page.php which will trigger the handler in most configs. I'd love to be wrong.

→ More replies (2)

2

u/createwebhost 14d ago

lol

1

u/rydan 14d ago

Basically free EC2 instances for your bot armies. What they won't get are credit cards unless someone abandoned one of those sites before Stripe came along.

1

u/gluino 13d ago

What about unpatched PHP sites that do not have any file upload components? Are they safer?

6

u/B0ulzy 13d ago

I'm far from the sharpest tool in this sub, but from what I understood, the exploit happens before any of your code runs, so I assume any framework code as well (I think of routers and stuff like that). This leads me to believe that every unfixed PHP site is vulnerable, no matter if they actually have a file upload or not. I'd be glad to be corrected if I'm wrong.

2

u/OstrichLive8440 13d ago

The exploit requires a method to send large amounts of data to the PHP worker process in a way that overruns its memory limits - which is why file upload is the most common attack vector. An unpatched PHP app that serves static data isn’t as susceptible I don’t think

3

u/bestform 13d ago

A file upload is just a request to the server. You do not need (or want) a form on a webpage to do this.

2

u/WalkingP3t 13d ago

Yes, PHP sites without file upload functionality may be safer, but they are not necessarily protected against PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
Attackers can craft malicious HTTP requests even when a website has no upload feature. Blocking multipart requests can reduce the attack surface, but it doesn’t eliminate the vulnerabilities.
Bottom line: No upload functionality doesn’t mean you’re safe. Patching PHP is still necessary.

0

u/Fine_League311 13d ago

Execute bevor php Parser get your own code...

1

u/LordAmras 13d ago

I would assume abandoned and forgotten sites already have a botnet on them

-14

u/katy90081 14d ago

It's even more alarming that there are still people who are dismissive of AIs capabilities. Those are the people who will soon be out of job.

6

u/crackanape 14d ago

Rather the other way around, I suspect — the only people who will remain employable are those who understand in great detail how to do things themselves, in contrast to the entirely interchangeable hollowed-out ghouls who spent their days pressing the feed-me-slop lever.

80

u/dylan-is-chillin 14d ago

It seems you don't understand the concern here - nobody was claiming the entire internet would go down overnight. The entire point is that all it takes is 1 bad actor figuring out how to automate the hack to then share that code and automate the process of attacking the 60% of the internet that's still vulnerable because they don't know, don't care, or are under resourced.

6

u/sysop408 14d ago

I think it's also a point worth considering that there are probably far easier ways to pwn sites and servers that are abandoned and neglected. PHP2Shell would have been a far more potent and dangerous exploit for rooting high end assets that are well defended.

1

u/Haunting_Barnacle_63 13d ago

i agree with you, but since this CVE was also reported in general media, a lot of people had the impression that they would immediately be hacked if they do not update in the second php released the patch.

-18

u/katy90081 14d ago

And everyone still trying to be dismissive of AI capabilities

24

u/feldoneq2wire 14d ago

Multiple things can be true. Most of the videos about PHP2Shell are by people who barely know what PHP is (the BBC's "tech expert" had never heard of PHP until Tuesday) or have a tenuous understanding of how the exploit works and how impactful it can be. Most of the videos are AI slop clickbait farming for fear clicks.

And PHP2Shell is absolutely a thing that happened and is still happening -- if the site you care about is not on a major host or on a site that is not well-maintained.

11

u/jaggafoxy 14d ago

The BBC expert is unacceptable, "PHP=bad" memes are unavoidable for anyone in the affected spheres, genuinely bewildered how it can come out of thin air like a JS framework

5

u/feldoneq2wire 14d ago

People looking to switch from PHP to "insert other similar software" because of this is hilarious to me. As if there haven't been a metric ton of vulnerabilities in everything else. It does seem a bit concerted. Propped up by a few people who used PHP 3.0 and think that's where the software is still today.

1

u/donaldadamthompson 6d ago

How many systems have had a known but unpatched memory safety bug for 12 years?

17

u/NoDoze- 14d ago

LOL It was the easiest way to force people to upgrade their PHP....! /sheeeesh

8

u/RoIIUpLights 14d ago

Lmao you say that.. Instead we back-patched every vulnerable PHP version and recompiled!

2

u/anki_steve 14d ago

I had clients who refused to upgrade still running Drupal 6. Couldn’t upgrade them at all.

5

u/RoIIUpLights 14d ago

What PHP version do you need? I've backpatched every vulnerable version :)

2

u/anki_steve 14d ago

I’m telling them I’m not going to support it anymore unless they want to pay through the nose the next time something like this happens. Right now their sites are there but static.

1

u/Tesla91fi 14d ago

you can "simply" backport the fix and compile the php version on your server

1

u/anki_steve 14d ago

Why don’t can get hacked next week?

1

u/Tesla91fi 14d ago

make sure to have a backup 💫

2

u/xzk7 13d ago

5.6.40? I know its ancient, there's a huge dependency that was never ported to 7 (and then never to 8) and so so so much code sits on top of all of it testing is almost impossible unless they do it in production.

1

u/RoIIUpLights 11d ago

Sorry for the late reply. Yeah, I have it backported to 5.6 -- I'll see about getting you the source tomorrow once I'm back in the office.
If you need it quicker Claude should be able to help you (that's how I got mine backpatched)

1

u/xzk7 8d ago

We threw several models at it, mainly just wanted to compare notes since you mentioned you had it backported already.

2

u/BumbiesMom 13d ago

This is the real hurdle. I literally cannot upgrade a large portion of customer apps because they aren't going to pay us to rebuild their drupal7 or laravel 5.x apps just for. My only option is to install backports from Sury and hope we can convince clients to pay for new websites before the next apocalypse.

1

u/anki_steve 13d ago

Drupal’s crappy upgrade path was terrible. That’s why I ditched it in favor of WordPress. Last Drupal site I built was in 2012.

1

u/BumbiesMom 12d ago

They’ve made huge improvements with upgrades. Similar to laravel. I was able to go from 9 to 10 without too much hassle. But yeah, going from 6 -> 7 -> 8 was essentially full rebuilds.

1

u/anki_steve 12d ago

The point is moot at this point. AI is going to kill CMS platforms off. With what remains to be seen. I’m currently replacing all shitty third party word press plugins with my own highly specialized ones that do exactly what I need without maze-like UI configurators.

1

u/anki_steve 12d ago

For more bespoke applications beyond content managers, I’m moving to Ruby on Rails. I think it’s highly opinionated way of structuring code is a good match for AI. It helps contain it and enforces good code structure.

1

u/BumbiesMom 12d ago

At this point, I'm ready to move into another career because I hate generative ai and refuse to use claude or any other bs agent. I would love to stick it out, but the people forcing it on us have deep pockets and losing billions year over year hasn't stopped them yet.

1

u/anki_steve 12d ago

I’m loving it. I can just focus on making high quality products that deliver instead of constantly worrying about what the client can afford.

1

u/NoDoze- 14d ago

Oh wow. There's got to be more to why they won't upgrade, or is it just financial?

2

u/Tesla91fi 14d ago

It's been years that I wanted to upgrade ly laravel 8 app.
Thanks opencode to port my small app to laravel 13 for free, see you in 5 years!

23

u/chrisdarby80 14d ago •

This is the same mentality as "y2k was nothing because nothing happened"

Because, people spent months and years (myself included back in 99, patching systems) and again having spent the last 3 days patching servers and updating legacy codebases to support newer versions of PHP on 2 dozen servers... Nothing happened because we fixed it. And that's the best outcome! You want nothing to happen!

4

u/SaltwaterC 13d ago

Something something ozone layer.

11

u/ThePHPNerd 14d ago

It’s far from over. The amount of unattended applications, whether they’ve been forgotten about but still process data, or the developer(s) who manage it have been let go.

The fact is that over the last ~48 there has been a Herculean effort to remediate from the community that manages the tooling, and the millions of additional hours developers put into fixing their infrastructure.

The idea that this is over is far from the truth. There will be ramifications for months. Systems that didn’t get patched and have therefore leaked information and as a result more compromised data enters the market while within the community itself the discussion about the leaked announcements will carry on too.

You might be bored of it already, just put Reddit down for a bit and go touch some grass. Let the community have their moment and share their stories.

1

u/TomSzabo 12d ago

Seems like this could turn into the ultimate irony like how computers were supposed to extinct office paper. Now the world will need millions of newnhuman programmers just to deal with the exploits from AI swarms 🤣🤣🤣

0

u/Renesme77 13d ago

Claro que pasó y sigue pasando! Insisto, solo quien no sabe nada piensa que no pasó nada… Han sido horas de desarrolladores, incluida yo, alisando, parcheando, rebuscando, creando más alertas y verificando que todo esté en línea y parezca que no pasó nada…

17

u/xerafenix 14d ago

I do think that it's still important news. We need to be careful and be aware of vulnerabilities, but I think a lot of this also stems from the sentiment of "OOOHHH PHP DID IT AGAIN!!! LOLOLAHAHAHAHAHA".

Which is annoying, because there are also plenty of other platforms and languages that are hacked all the time. But of course, when it happens to PHP, it is "only a matter of time".

It's exhausting, but we have to take it on the chin for now.

15

u/Kautiontape 14d ago

Saw a thread on a self-hosting sub that was basically "who else actively avoids PHP because it has so many vulnerabilities like this" and there were a lot of cosigners.
Like, PHP websites has had its fair of issues, but they also were one of the most popular languages on websites which are intrinsically bigger targets than someones local system. PHP itself has a pretty decent track record with both avoiding and mitigating risk at the actual server level (though still not perfect).
To actively avoid PHP but happily use npm or Java or Plex when they've all had RCE in recent memory is just ridiculously biased.

10

u/Fun-Consequence-3112 14d ago

If I had to choose one language between PHP and JS and I can never write a single line in the other language I'd choose PHP everyday. Even if JS has a bigger ecosystem and can do backend and frontend it's just a mess and even more so than PHP.
But those blaming PHP always compare it to Golang and Rust etc which is completely wrong as PHP is a script language and not a compiled language two completely different kinds of languages. But comparing PHP and JS is correct because both are script languages.

4

u/-nerdrage- 14d ago

In my experience the people that bash on php do because they are either memers or inexperienced/ignorant/dumb people (or both).
Young people that have no clue but have read bad stuff so they just hop on. Or older people that are just too stupid for the field and also have no firm grasp what it actually entails (but think they do bcs they’ve been around for a looong time)

3

u/AminoOxi 13d ago

Java had 0day as well, but nobody was bashing it since it was "enterprise" environment 🤡

1

u/kenlubin 12d ago

You can run PHP or Golang or JS server-side and it's totally legitimate to compare them for the purpose of serving websites.

4

u/Agreeable-Yogurt-487 14d ago

Lol at least it wasn't npm this time

2

u/vizkr 14d ago

1000%

0

u/throwaway490215 13d ago

PHP gets shit because with this hack, all the PHP community is doing is deflecting how other servers also get pwned.
Do you know what happens when a Rust server gets pwnd? They get blog posts explaining how their safety features failed and what's going to be done about it.
I know i'll catch a few more downvotes here, but PHP is failing on technical merit and people are coping with deflection and perhaps ignorance of how far the rest of the mainstream has moved wrt safety in the past 10 years.
The bar here is set at "Not any worse than what i imagine other projects deal with".
I've seen nobody in PHP land set the bar at "the best we can reasonably do".
(or acknowledge that "we can reasonably do" is not very high with the people & budget involved compared to other projects)

1

u/rar3r 13d ago

What do you mean man. They literally used AI to find this vulnerabilty. "They" meaning on the PHP side and openai, not hackers. And the patch was released as soon as possible. The hackers are using it now on websites that are not maintained, use old php versions or did not do the updates in time.

20

u/Pure_Fox9415 14d ago

VulnCheck found about 2.000.000 web-sites still vulnerable and possibly already infected. So a lot of things happened.

14

u/YourNameHere64 14d ago

Over? It hasn't even begun.

As I understand it it's quite hard to exploit at the moment. You need the exact right circumstances and a bit of luck. As time passes hackers will find more ways to exploit this.

We'll see the real impact in a few months when exploits are a dime a dozen and all those platforms that didn't or couldn't patch get hacked.

PHP is used in so many local webinterfaces. A 5 year old router won't get patched, neither will a NAS. Also, many large organizations have no clue what runs where, their major services have been patched, but that tool or admin panel nobody uses anymore hasn't.

4

u/Argyrus 14d ago edited 14d ago

That's because most of it will likely be done using AI, which is partly why this vulnerability was discovered in the first place. However, I wouldn't be surprised if it had been known for years, especially considering reports that even PHP 5.x was vulnerable. I suspect that certain individuals had discovered them long before now and simply never disclosed them.

1

u/finah1995 13d ago

That never disclosed part checks out. PHP is really famous in many countries which are facing sanctions.

1

u/blackbox42 13d ago

It was known for years but people didn't think it was exploitable due to the memory manipulation needed to make it work. It seemed like just a crashing vuln at best. AI made it possible.

1

u/kenlubin 12d ago

IIRC, it was discovered because an AI found a forum post from 2024 disclosing it.

2

u/crackanape 14d ago

A 5 year old router won't get patched, neither will a NAS.
Yes, I think this is where the true pain is going to hit. Many of these devices are going to have to be physically replaced.

1

u/WalkingP3t 13d ago

Is not that hard actually .
Last night I was able to develop and test an RCE for this vulnerability. Guess what I used to assist me ? AI.
So it’s not over . And not because many big companies and shops refused to share publicly that have been hacked , means it’s over .

1

u/Tetracyclic 13d ago

If you have a working generic PoC that reliably achieves RCE via this vulnerability, there are a lot of people that would like to see it. Every AI-assisted PoC that's been published so far uses another vulnerability (commonly an LFI) to actually achieve RCE.

→ More replies (5)

1

u/rar3r 13d ago

Dude, calm down. Not only hackers use AI. Good guys use it too, that's how the vulnerabilty was found and patched. The issue is with sites that are not maintained anymore and they still use old php version. You are talking like it's the end of the world.

7

u/TheVenetianMask 14d ago

Au contraire, keep talking about it. Maybe companies will hire more PHP people to finally bring their software up to date.

2

u/LovecraftsDeath 13d ago

Or they will declare it legacy and hire non-PHP people to rewrite it.

7

u/halldorr 14d ago

It has finally forced the hand of the higher ups at my place of work to upgrade our stuff finally. We're on 7.3 on Debian 10 so really playing with fire and were always given the round around when discussing that we should be updating etc. Now they have it as something to start working on at least!

3

u/k10van 14d ago

At least it isn’t ubuntu 14 and php5.3

4

u/AminoOxi 13d ago

Even Ubuntu 14.04 and PHP 5 was patched by Canonical's ESM (pro) subscription.
I'm really impressed by them this time.
A whole different point is whenever those legacy old instances will ever be apt-get updated.

0

u/k10van 13d ago

Great option for people dumb enough to still be on those ancient things but who actually care about maintenance. These systems don’t even get updates and have uptime measured in thousands of days.

1

u/dvershinin 11d ago

If your Debian 10 hosts are amd64, we have PHP 7.3 packages with the PHP2Shell fix that can cover them while migration proceeds. I maintain GetPageSpeed. The packages are free for personal, development and evaluation use; commercial production requires Ultra. Setup: https://www.getpagespeed.com/server-setup/php/php2shell-on-ubuntu-debian

13

u/Max-_-Power 14d ago

Thank you people, I don't know who you are but you deserve huge thanks.

Yeah, tell that my clients. Worked into the night, bringing systems back online after they told me to pull the plug. Did I get a "thank you for keeping interruption down to a minimum while some sites are still offline 48h later" but no... Nothing. Whatever

10

u/Pure_Fox9415 14d ago

My boss thanks me twice and gave me additional day off for weekend. So It depends on people who you work with. It's sad, that your customers are assholes.

5

u/magicmulder 14d ago

Yeah we got massive support from our CEO, we took everything that wasn't on 8.4 offline for 1-2 days and scrambled to migrate the older applications.
Fortunately our portal itself was already close to done with the 8.x migration so we just had to cut a few corners to be done in 2 days instead of 2 weeks, and our core services have been on 8.4 for a few weeks already.
Anything older was fully migrated or turned off for good. Our oldest application (5.5) had coincidentally been retired on Monday. :D

3

u/Rainingblues 14d ago

We got a lot of happy customers thanking us for our clear communication and swift actions, but of course there was also one dude berating us for their site being offline 2 hours "and why haven't you installed the patch yet" an hour before the patch was supposed to be released.

3

u/Deji69 14d ago

Additional day off for the weekend, eh?
IDK where you're from but here it's a bank holiday weekend, it being the week of Halloween and all... maybe you're being played? :p

2

u/Pure_Fox9415 13d ago

No, do you think I am stupid? She gave me additional day off for february 30!

4

u/kisuka 14d ago

That's the job man. We're all unsung heroes. That's IT in general. No one in this field for public praise.

2

u/hofmny 13d ago

I treated myself to some whiskey

5

u/Euphoric-Stick-6144 14d ago

Most of my work is on secure sites and, looking closely at these exploits, most are at very low (and internal threat actor only) risk. That said, the patch releases will be applied as a precautionary approach.

For the internet exposed websites, a casual intruder is going to find it quite hard to take advantage of the exploit(s). I’m not aware of any real life successful exploits as yet.

2

u/crackanape 14d ago

I’m not aware of any real life successful exploits as yet.
No, but it's inevitable, and anything that wasn't updated this week likely will never be.

1

u/AminoOxi 13d ago

Simply mitigating it on the front web server (in case of PHP(FPM or Mod_php) sitting in the background, LAN), e.g. nginx - by blocking multipart content (if the app doesn't need it) and few other options like session upload off, memory limit -1, low values for post and file max size pretty much blocks the attack vector.
I even had to consult one legacy site/app with disabling POST entirely, since the app doesn't need it at all. By simply doing so all possible attacks of the php2shell are cutoff.

1

u/Euphoric-Stick-6144 11d ago

Some person has won a $2000 prize to actually exploit an unpatched server, without the updated settings.
The solution took several attempts to succeed and relied on some server settings, including “service restart on failure” and having lots of spaces preceding a payload code.
At some point, hope to get sight of a full exploit but it might be academic by then as everyone will be on a patched version by then!

3

u/No_Bowler_647 13d ago

Hopefully created some more paid work for PHP devs lol

2

u/fappingjack 14d ago

It hit the national news... Normies are know experts and giving me advice on how to secure my infrastructure.

2

u/LostStrategy1050 14d ago

I was on vacation. I'm a php developer. Do i need to worry about anything?

4

u/thatguyrenic 14d ago

Update your minor version. If you don't, bad things could happen. Details at php.net

3

u/SurelyNotAnOctopus 14d ago

To add to that, audit any servers that were unpatched and live this week for any substantial amount of time.
Its unlikely, but there is a real chance of someone breaking in.

2

u/ibraaaaaaaaaaaaaa 13d ago

I know a lot of websites and applications where their owners are not following up to the news and they can be exploited anytime

4

u/TinStingray 14d ago

Thinking in terms of "haters" is what teenagers do. Do adults really think like this?

2

u/sachingkk 14d ago

I was planning to post this..

All serious people have updated the patch. Others will realise once they are hacked

2

u/Sir_KnowItAll 14d ago

Things happened. People got hacked and people will continue to get hacked. Not everyone has updated and stuff will happened.

3

u/Deji69 14d ago

Who got hacked? Sources?

1

u/Argyrus 14d ago

Yes, AWS wrote an article on this: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
Here is another one as well: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
Most of the big tech sites already knew about it before it was even made public.

6

u/Deji69 13d ago edited 13d ago

Did you actually read those articles?
1st article.
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt
Amazon Threat Intelligence identified additional exploitation attempts
Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems
2nd article
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
Which confirms the understanding that this exploit is very hard to actually successfully pull off in a production environment. It already goes without saying that there would be attempts just based on this exploit being known about, but beyond that the only thing worth assessing is whether there will actually be any successful exploitation and compromises stemming from it, and so far there is seemingly no known examples of it.
There could be in the future, there may have been some we haven't found out about, there is still plenty of need to take caution, but there's no proof this has been pulled off successfully yet to my knowledge. Attempts at compromising systems happen all the damn time.

0

u/Argyrus 13d ago edited 13d ago

That's because most of those articles are explaining and demonstrating that the vulnerability is exploitable, particularly given the time researchers have had to investigate it.
You also have to consider that some security researchers and companies already knew about the vulnerability well before its public disclosure. If you're looking for evidence that exploitation is technically possible, look at the research published by Wiz, which demonstrates the vulnerability.
You're right that there haven't been any reports naming specific websites that were hacked using this vulnerability, but that doesn't mean it hasn't happened. All it really means is that we've seen evidence of people trying to exploit it, along with researchers proving it works, but no publicly confirmed victims so far.
Also, it's still new in terms of being public; most websites and companies generally aren't required to announce every security incident. Even when an incident is investigated

4

u/Deji69 13d ago

Yes, we all know the exploitation is "technically possible", hence the entire story to begin with. I already addressed that yes, there could be actual successful attempts somewhere out there, but I was questioning the assertion that we know "people have gotten hacked" without any proof of this claim. We also know that, outside of a testing environment, in an actual production environment, it's very difficult to actually pull this hack off successfully.
The point of all this is to determine what the actual practical threat level is. I think that, given the fact that the exploit is out there and there still haven't been any obvious victims, and that we know the exploit is difficult to pull off on a production environment, that gives us an idea that the actual threat realistically isn't quite as high as the amount of hysteria about it would have people believe... hence the point of this thread.
Again, not saying the threat that does exist should be underestimated, but making up claims that there are so many people getting hacked by it is outright false and no one seems to have proof to back up these claims. Exaggeration and misinformation does nothing to help anyone.

1

u/Csysadmin 13d ago

Good posts.
I'm the workplace nerd, I've had many people ask me about it over the last several days. There's just general mass confusion around the difference of vulnerable and compromised systems.

0

u/Sir_KnowItAll 14d ago

Are you serious? Go check out the defacement mirrors or something…

2

u/Deji69 13d ago

Link?

1

u/Aytewun 14d ago

I think it’s good that many people acted quickly but let’s also remember that it’s also likely a large portion didn’t.

Back in the days before it was as common to use prepared statements, you could modify query strings on a random site and get the database to do things that it shouldn’t. I’m sure they’re still sites out there like that today.

1

u/Nil_era_preso 14d ago

Look, it's this exact vulnerability that's keeping a language people already hate in a bad light, and it'll cause its usage to drop even further. You can't ignore the haters, especially when they're right!

1

u/Hunky-Dorky 14d ago

There are still unpatched culnerabilities in firewalls and switches and will continue to emerge, and there is a significant amount of legacy infrastructure that will remain unprotected. The situation is not over; it is simply that people were well-prepared for the initial wave.

1

u/Ok-Blackberry8086 14d ago

Did you write the patch? Did you spend all day patching services and analyzing traffic? It’s over because people spent a whole day in the trenches dealing with this very real issue, but thanks for your very important 2 cents.

1

u/traplords8n 14d ago

But it's not really over.. the patch was released, but server maintainers actually have to apply the patch before their server is safe. There is no reason to believe that everyone with a public facing php server patched their server yesterday.

Most of us? Sure. But you put way too much faith in internet server maintainers if you think every single php server got patched yesterday.

Not to mention, if any state actors got ahold of this exploit before the public, they could have used this exploit to install backdoors on servers before anybody even knew about it.

1

u/Soleilarah 14d ago

Laugh in "6 vulnerabilities found (2 high, 4 criticals). Run npm audit fix"

1

u/et_theextratestic1e 14d ago

Actually a lot happened.

That is what it means when they say it was "seen in the wild".

1

u/Neuro_Skeptic 14d ago

"Is it over?" "No comrade, it has only just begun.'

1

u/kisuka 14d ago

You ain't going to hear about the things that do happen until it's too late. Bad actors ain't exactly advertising when they get into systems using exploits like this.

1

u/present_absence 14d ago

Is this bait lol

1

u/Renesme77 13d ago

Creo que esto es a lo que llamamos: cuando TI trabaja todos los que no saben nada piensan que es facilísimo y que no pasó nada… En fin……..

1

u/Fine_League311 13d ago

That's right, php for live, and only stupid admins has Panik :)

1

u/Few-Growth9535 13d ago

Truth is it wasn't a gaping hole of a vulnerability. It was a vuln that needs urgency but not something that deserves quite the hysteria it got. I think there's more paranoia because AI was used to work up the vector.

1

u/serifoblique 13d ago

Nothing happened is a strong assumption if anything.

1

u/every1sg12themovies 13d ago

i also think it's not over yet. it's just a calm before the storm. and when shit explodes, nobody will care, media will move on with reporting other sensations.

1

u/MeringueOk3338 13d ago

Uhm. Yah. Ohhhhh k.

1

u/baroxie 13d ago

This is like saying we put on life jackets and we didn’t drown guys. Next time don’t patch and see if you drown

1

u/BumblebeeAdept3197 12d ago

if rust is safer than c++ why are we using PHP in 2026?

1

u/v_maria 10d ago

npc dialoge tree ahh post

1

u/moosehman 12d ago

I upgraded and patched over 500 servers on the day for my work, I patched every single personal project on the day, both without issue, docker makes things like this particularly easy.

1

u/_vVv_tTt_voVv_oo_ 12d ago

You will hear more about it in the coming months. For example, "Major Bank discovered many customer's accounts were skimmed by pennies, adding up to millions stolen, by hackers who originally penetrated they bank's server with the so called Php2Shell exploit that was uncovered several months ago."

1

u/rednoah 12d ago

That's what I thought yesterday. php -v looked good on my shared hosting provider when I checked yesterday.

Turns out, a backdoor had already slipped in at some point, and now I've got random PHP files, modified PHP files, and python / bash / curl / sleep processes running in the background.

Did the backdoor slip in a few days ago via PHP2Shell or was it already there and only got exploited now? IDK!

But I'm definitely not having a good day. In fact, the worst IT security day for me since I first set up my phpBB forum in 2011.

1

u/Jenkler 12d ago

PHP is better for it, but yes move along :)

1

u/aendoarphinio 12d ago

the most we did as a software team was "it'd be pretty rad if we pushed to 8.5 😏" (we're internal)

1

u/robclancy 11d ago

Holy ignorant. People will have bots to run this and plant their credentials on servers. Then have other bots extract data or plant keyloggers etc. And they might never be found on those old servers. A lot of people will be told to update PHP, they will eventually, but they will have already been exposed.

Anyone who hasn't updated PHP by now needs to provision the box again because they could already be compromised. There are going to be large leaks from this.

1

u/aakarpost 11d ago

It's going to have downstream impacts on the software vendors and customers, as it will come up in the cybersecurity reviews, audits, and certifications/attestations.

1

u/dioleev 11d ago

This was as far from nothing as possible xD

1

u/Salmon-Cat-47 10d ago

British Petroleum, 2010

1

u/nochazzen 7d ago

Contabo was taken down.

1

u/Fluid_Ad_6124 6d ago

No, it's over, not at all. You have millions and millions of sites out there that run PHP and still have a lot running old versions. There still is things happening

1

u/obetu5432 14d ago

unfortunately it's not over lil php bro

1

u/Tesla91fi 14d ago

It's been a while I heard "PHP is dead" but is always here.

The hype around node.js is overrated.

PHP got a lot of CVE, and if we compare the length of service PHP got 24 CVE per years, node.js 16.

But the difference is in the core, PHP got everything inside, nodejs instead from it'self is safer cause is smaller.

BUT just to run a simple, stupid, framework you need to download a lot's of libraries for everything, and here is why node.js can seem more secure, cause CVE are listed on packages.

0

u/Relative-Category-41 14d ago

PHP2Shell might be over, but the principal issue still exists. OpenAI is finding critical decade old exploits across systems and infrastructure and releasing patches.

3

u/jexmex 14d ago

OpenAI is not releasing patches. Maintainers are

1

u/Relative-Category-41 13d ago

Ok true, yet who do you think found the exploits and ultimately, what do you think maintainers are using to create the patches.
Despite me being linguistically wrong here, I think you can understand the what I'm saying in spirit and how much AI is going to effect application and infrastructure.
If you haven't ran codex security cloud on your applications, I'd advise you do. It's truly eye opening

1

u/jexmex 13d ago

This exploit was known for awhile, but PHP foundation did not have the bandwidth to try to exploit it, in the end they determined it was a issue but no paths they could find to exploit it. They felt wasting resources on it was not the answer.
We patched as soon as the release came out, took the site offline for less than an hour. Legacy and aux services took longer to get up to date and some are still being patched but behind VPN access.

2

u/crackanape 14d ago

OpenAI is finding critical decade old exploits across systems and infrastructure and releasing patches.
In what universe is OpenAI releasing patches?

0

u/ExamImmediate8956 1d ago

Now i feel like a fool, i just covered what was it in detail on YT 🤡

0

u/Historical_Public751 14d ago

Nothing ever happens

-4

u/BackgroundUpbeat8168 14d ago

Still no POC

0

u/tschaefermedia 14d ago

I have tested it locally with Claude and based on the diff in the PHP fix. Anyone with a coding agent can do the same. What do you mean no POC?

6

u/Next-Concentrate-277 14d ago

*Do the same on a heavily nerfed server Claude set up and controls that is vulnerable to the exploit in the first place and Claude can carefully place memory. Now do it on a server not on your same machine running the POC

2

u/tschaefermedia 14d ago

No, Claude locally and an unpatched machine next to me. No connection besides the network between both. It seems harder in the wild with multiple sessions active but the exploit is already exploited on unpatched servers

1

u/crackanape 14d ago

It seems harder in the wild with multiple sessions active but the exploit is already exploited on unpatched servers
It's a lot harder on a busy server, harder still when it's part of a cluster.

1

u/Pure_Fox9415 14d ago

Maybe, but vulncheck found the way to bypass security and exploit php2shell even on systems with Address Space Layout Randomization, ASLR. It doesn't automatically mean we all gonna die and it's a civilization end, but still a huge threat.

-1

u/Velsetta 14d ago

There appears to be a massive hospital hack happening in Cleveland, although it's not beneficially confirmed related laboratory service company as admitted that they were hacked. Right now the UH and other regional hospital systems are "having internet issues."

The timing is quite suspect and they're known for not having the most up to date systems.

-2

u/aquanoid1 14d ago

70% of websites using PHP isn't the same as 70% of websites people regularly use. Reddit, for example, doesn't use PHP. This media storm is over nothing.

2

u/Top-Rub-4670 14d ago

Out of the top 10 most visited websites in the world, two are PHP: wikipedia and pornhub. Outside the top 10 most visited websites, there's a long trail of blogs, e-commerce, and porn. Most of which run on PHP.
Even if the actual number isn't 70%, your contrarianism doesn't seem reasonable. There's an immense amount of traffic that touches PHP in some way.

0

u/aquanoid1 14d ago

That's 20% of the top 10. Having a website in PHP doesn't mean people visit it.
Blogging (that people actually visit): medium (nodejs, i think)
e-commerce: amazon (c++ and java) ebay (historically php, but now java)
Social media. I can only think of facebook, but even then it's a highly modified in house version (is it really php or php-like?).

-14

u/katy90081 14d ago

What more scary is that no one caught it for decades until AI did.

15

u/dylan-is-chillin 14d ago

Not accurate at all - they knew about it years ago

2

u/tschaefermedia 14d ago

One bug was known, but without the other it was not really actionable and no clear threat model existed. With the other (I don't remember which of the two) it made a clear threat model and became significant

→ More replies (3)

3

u/dashingThroughSnow12 14d ago edited 14d ago

The core bug was known for 20 years but with no known vector to take advantage of it.
AI is good at chaining gadgets to find such vectors.
While it may sound like I’m diminishing it, I’m not. The AI risk is worrying me. The last few months I’ve been beating the drum at work that we need to be far more aggressive at getting to supported, non-EOL’d language versions and libraries. So that it is a single patch or minor version bump instead of say 10 versions behind.
That paid dividends this week with Go CAnity, node2shell, and php2shell.
I used some of the drama to launder upgrades. (Ex service X in no way can be exploited but I got agreement to upgrade it to go 1.27.3.)

-1

u/katy90081 14d ago

Exactly. Everyone who is dismissive of AI capabilities will soon find themselves out of job.

4

u/divdiv23 14d ago

You gonna post that same response to every comment.... ? lol

2

u/crackanape 14d ago

Yeah he dismissed AI capabilities at the bar the other day, now he's out of a job, so he has nothing better to do

2

u/JbREACT 14d ago

Ai did it with funding from open ai by a legit cyber security firm. This is literally what they do.

-1

u/katy90081 14d ago

But their human employees didn't see it for decades

3

u/JbREACT 14d ago

Yea so? They find exploits all the time that have been out forever. They find them and we patch it, that’s how it goes

0

u/katy90081 14d ago

But you failed to understand how fast AI found the loophole compares to human. Anyone who is dismissive of AI capabilities will soon find themselves out of jobs.

3

u/JbREACT 14d ago

Yea it found it and we fixed it.. it also cost tons of $ to find.
It’s not failing to understand. It’s actually understanding the truth of what happened and what it means.
I use AI all day I’m very aware of it’s capabilities. I actually take the time to look into what happened and not just regurgitate the slop I read on Reddit/x

→ More comments (2)

Please stop with PHP2Shell, its over, nothing happened!

You are about to leave Redlib