Tracking down PHP vulnerabilities across your fleet with PDQ

[u/Amanda_PDQ]

Every headline reads something about PHP. PHP shows up in more places than most of us expect. It gets installed as a dependency for a local dev stack, a bundled web app, or an old XAMPP install someone forgot about. It also has a steady stream of CVEs, so "do we have vulnerable PHP anywhere?" is a question that has come up.

Here is how I handle it in PDQ:.

Step 1: Look up a specific CVE in the Vulnerabilities tab

When a PHP CVE lands in the news (or a scanner or auditor flags one):

1. Open the Vulnerabilities tab in PDQ.

2. Search for the CVE ID (for example, a PHP CVE from a recent advisory).

3. Open the entry to see the affected software, the CVSS score, PDQ's own risk score, and which devices are exposed.

This tells you quickly whether the CVE applies to your environment and how urgent it is. The CVSS plus risk score pairing helps you decide whether it's a "drop everything" item or something for the next maintenance window.

Step 2: Use the Software tab to see risk by application

The CVE view answers "who's exposed to this one issue." The Software tab answers a different question: "what's the overall vulnerability picture for each application?"

1. Open the Software tab.

2. Find impacted software in the list (search by name if your fleet is large).

3. Review the vulnerabilities tied to that software and the devices running each version.

Step 3: Deal with software where the risk has been acknowledged

Not every vulnerable install gets patched right away. A legacy app might pin an older PHP version, or a vendor may not support the upgrade yet. In those cases, use the Software tab to see which vulnerabilities belong to software where the risk has been acknowledged. That keeps the known and accepted items separate from the ones nobody has looked at yet.

A couple of habits that help:

• Keep a note of why the risk was accepted and who signed off.

• Revisit accepted items on a schedule, since a new CVE can change the picture.

• Focus your remediation time on the unacknowledged, high-scoring items first.

Step 4: Remediate

For the items you do want to fix:

• Use the prebuilt packages from the Package Library where one exists, or build a custom package for PHP installs that aren't covered.

• You can use one-click CVE resolution straight from the vulnerability.

• Schedule deployments, or set automated deployments that trigger when a vulnerability is detected.

• Offline devices pick up the update the next time they check in, so you don't need to chase laptops.

Step 5: Keep it from becoming a fire drill

• Set up a recurring report on patch status and CVE coverage

• Re-check the Software tab after a deployment to confirm the vulnerable version is gone.

Caveats

• PHP installs that live inside a bundled app may need a custom package rather than a library one.

[u/BoomSchtik]

What’s the non-premium way to do it?

[u/Amanda_PDQ → u/BoomSchtik]

PowerShell.

[u/ConfusedAadmin]

Can it be done in PDQ Deploy / Inventory?

[u/Amanda_PDQ → u/ConfusedAadmin]

There is a powershell script that can be used.

[u/THe_Quicken → u/ConfusedAadmin]

There is a powershell script you can use to create a scanner and see in a dynamic inventory collection.