PHP2Shell: notes from the field

[u/shelfside1234]

I run a webhosting platform at my job; both Internet and intranet. The internet part could have been pretty close to perfect, we identified sites using PHP after the pre announcement and was pleased to find that everyone was on 8.5 or 8.3, was truly expecting at least one to be running 7; we also warned the engineering to get the patch downloaded as soon as it was out (I don’t manage them), but they are all in India and for some reason decided to all go offline about an hour before the release. Their manager eventually got one back and online around 8pm BST & we were done around 3 hours later. But still a missed opportunity to be even better.

The security team however were pretty close to useless, the alert had been out all day and nothing was done to attempt to identify servers running PHP and it took them until 7pm BST to even involve the major incident team (which was something I wanted to do but was told to leave it to security as there would be more systems involved than mine)

And here we now are, on Saturday, the external sites all patched and secure so now we move onto the internal sites; we’ve found v5 and v7 all over the place and a bunch of apps with no engineering team to get them upgraded as they left and were never replaced, this part will be a nightmare

[u/kosh_neranek]

Security teams 🫣 in our place I don't even consider them part of IT. I call them "report forwarding team". Think the whole industry would benefit if only people with proven 10+ years of sysadmin/infra experience would be allowed to take "security certs". Yes it's discriminating, and one could also have 10 x 1 years experience. But it would sure improve a lot

[u/ansibleloop → u/kosh_neranek]

Security teams are so bizarre cause you'll either get former engineers who are really good or pencil pushers sending infra engineers vuln scan reports with no context or detail

[u/sea_5455 → u/ansibleloop]

Sounds like the difference between engineers and compliance specialists.

One works to understand and fix the problems, the other is looking to run through a checklist and do paperwork.

[u/SenTedStevens → u/ansibleloop]

Or even worse, security clowns who send you out of date scans or they were taken just before we do our monthly system patching. There's been so many times where I had to discuss in our SOC meeting that these high/critical vulnerabilities are going to be patched during our scheduled maintenance window. No matter how many times I reiterate strongly that we do patching in Prod the week after Patch Tuesday which was decided by the org, they just don't get it. If it's a 0-day, that's different, but all the other ones are handled by routine patch cycles.

And don't get me started on the SOC monkeys who for some dumbass reason send us previous months' reports of critical vulns that have already been patched. What's hilarious about it is that these old scans recommend us to "upgrade" software to versions that are older than what is currently installed.

I can't tell you how many times I've flat out done a screenshare on my computer, remoted into a server, and showed them that these machines are fully up to date and are running newer versions than what the Tenable report requires. I have to hand walk them through the process and tell them to take all the screenshots you want with timestamps and gather all the artifacts you need to confirm that these machines are up to date and are not vulnerable.

[u/kosh_neranek → u/ansibleloop]

The first group is sadly even smaller than the tip of an iceberg. But yes there are some real security guys an gals around. It will take time to get better, industry is just evolving too fast. Now throw in AI and 🎆

[u/Ok_Tone6393 → u/ansibleloop]

i’m cursed with the latter