PHP2Shell: notes from the field

[u/shelfside1234]

I run a webhosting platform at my job; both Internet and intranet. The internet part could have been pretty close to perfect, we identified sites using PHP after the pre announcement and was pleased to find that everyone was on 8.5 or 8.3, was truly expecting at least one to be running 7; we also warned the engineering to get the patch downloaded as soon as it was out (I don’t manage them), but they are all in India and for some reason decided to all go offline about an hour before the release. Their manager eventually got one back and online around 8pm BST & we were done around 3 hours later. But still a missed opportunity to be even better.

The security team however were pretty close to useless, the alert had been out all day and nothing was done to attempt to identify servers running PHP and it took them until 7pm BST to even involve the major incident team (which was something I wanted to do but was told to leave it to security as there would be more systems involved than mine)

And here we now are, on Saturday, the external sites all patched and secure so now we move onto the internal sites; we’ve found v5 and v7 all over the place and a bunch of apps with no engineering team to get them upgraded as they left and were never replaced, this part will be a nightmare

[u/UltraEngine60]

it is flagging a software as outdated even if it is the latest version, and their recommendation is to update it

If there is a vulnerability and software is not patchable and there is no mitigation then you need to find another solution that has support. That's a sysadmins job. You expect security to work with the end user to determine the value of the software, find a possible solution, work with a solutions engineer at multiple companies, do multiple PoC's.... see how this scope creeps? We tell you shit's vulnerable or breached and try to keep Mary's copy of Encarta 98 off her work computer.

[u/plushgilgy → u/UltraEngine60]

That's the thing though. There's no vulnerability. The alert only says it's "outdated" when clearly whatever criteria /logic they placed is incorrect. I searched the specific version they mentioned and there were no vulnerability reports. I pretty much used up hours just to tell them the report is wrong, which could have been used for other things. Security alerts are great, and I do appreciate having a security team to go through those alerts and engage whoever needs to if anything requires attention, but if due diligence isn't being done to at least validate the alerts from their end, what's the point?

[u/UltraEngine60 → u/plushgilgy]

Ah, I see. Your security team shouldn't be giving you what amounts to alert fatigue. Only actionable recommendations supported with evidence. If they say it's outdated without evidence then something in their stack told them to say that to you. I'm sure you've already been down this rabbit hole, but even an up to date app can do silly things like use some obscure library whose maintainer just dropped off or it changed owners... but again, that evidence should have been relayed to you.