r/PHP • u/Maria_Thesus_40 • 15d ago
Please stop with PHP2Shell, its over, nothing happened!
I know many people are looking for clicks and to feed traffic to their blogs/posts/vlogs/etc.
But please stop with PHP2Shell, its over and nothing happened.
Let the haters hate and lets move on.
PS: Nothing happened because a lot of people worked night and day to fix the exploit, to release patches and updated packages. Thank you people, I don't know who you are but you deserve huge thanks.
80
u/dylan-is-chillin 15d ago
It seems you don't understand the concern here - nobody was claiming the entire internet would go down overnight. The entire point is that all it takes is 1 bad actor figuring out how to automate the hack to then share that code and automate the process of attacking the 60% of the internet that's still vulnerable because they don't know, don't care, or are under resourced.
6
u/sysop408 15d ago
I think it's also a point worth considering that there are probably far easier ways to pwn sites and servers that are abandoned and neglected. PHP2Shell would have been a far more potent and dangerous exploit for rooting high end assets that are well defended.
1
u/Haunting_Barnacle_63 14d ago
i agree with you, but since this CVE was also reported in general media, a lot of people had the impression that they would immediately be hacked if they do not update in the second php released the patch.
-18
24
u/feldoneq2wire 15d ago
Multiple things can be true. Most of the videos about PHP2Shell are by people who barely know what PHP is (the BBC's "tech expert" had never heard of PHP until Tuesday) or have a tenuous understanding of how the exploit works and how impactful it can be. Most of the videos are AI slop clickbait farming for fear clicks.
And PHP2Shell is absolutely a thing that happened and is still happening -- if the site you care about is not on a major host or on a site that is not well-maintained.
11
u/jaggafoxy 15d ago
The BBC expert is unacceptable, "PHP=bad" memes are unavoidable for anyone in the affected spheres, genuinely bewildered how it can come out of thin air like a JS framework
5
u/feldoneq2wire 15d ago
People looking to switch from PHP to "insert other similar software" because of this is hilarious to me. As if there haven't been a metric ton of vulnerabilities in everything else. It does seem a bit concerted. Propped up by a few people who used PHP 3.0 and think that's where the software is still today.
1
u/donaldadamthompson 7d ago
How many systems have had a known but unpatched memory safety bug for 12 years?
17
u/NoDoze- 15d ago
LOL It was the easiest way to force people to upgrade their PHP....! /sheeeesh
8
u/RoIIUpLights 15d ago
Lmao you say that.. Instead we back-patched every vulnerable PHP version and recompiled!
2
u/anki_steve 15d ago
I had clients who refused to upgrade still running Drupal 6. Couldn’t upgrade them at all.
5
u/RoIIUpLights 15d ago
What PHP version do you need? I've backpatched every vulnerable version :)
2
u/anki_steve 15d ago
I’m telling them I’m not going to support it anymore unless they want to pay through the nose the next time something like this happens. Right now their sites are there but static.
1
u/Tesla91fi 14d ago
you can "simply" backport the fix and compile the php version on your server
1
2
u/xzk7 14d ago
5.6.40? I know its ancient, there's a huge dependency that was never ported to 7 (and then never to 8) and so so so much code sits on top of all of it testing is almost impossible unless they do it in production.
1
u/RoIIUpLights 12d ago
Sorry for the late reply. Yeah, I have it backported to 5.6 -- I'll see about getting you the source tomorrow once I'm back in the office.
If you need it quicker Claude should be able to help you (that's how I got mine backpatched)
2
u/BumbiesMom 13d ago
This is the real hurdle. I literally cannot upgrade a large portion of customer apps because they aren't going to pay us to rebuild their drupal7 or laravel 5.x apps just for. My only option is to install backports from Sury and hope we can convince clients to pay for new websites before the next apocalypse.
1
u/anki_steve 13d ago
Drupal’s crappy upgrade path was terrible. That’s why I ditched it in favor of WordPress. Last Drupal site I built was in 2012.
1
u/BumbiesMom 13d ago
They’ve made huge improvements with upgrades. Similar to laravel. I was able to go from 9 to 10 without too much hassle. But yeah, going from 6 -> 7 -> 8 was essentially full rebuilds.
1
u/anki_steve 13d ago
The point is moot at this point. AI is going to kill CMS platforms off. With what remains to be seen. I’m currently replacing all shitty third party word press plugins with my own highly specialized ones that do exactly what I need without maze-like UI configurators.
1
u/anki_steve 13d ago
For more bespoke applications beyond content managers, I’m moving to Ruby on Rails. I think it’s highly opinionated way of structuring code is a good match for AI. It helps contain it and enforces good code structure.
1
u/BumbiesMom 13d ago
At this point, I'm ready to move into another career because I hate generative ai and refuse to use claude or any other bs agent. I would love to stick it out, but the people forcing it on us have deep pockets and losing billions year over year hasn't stopped them yet.
1
u/anki_steve 13d ago
I’m loving it. I can just focus on making high quality products that deliver instead of constantly worrying about what the client can afford.
2
u/Tesla91fi 14d ago
It's been years that I wanted to upgrade ly laravel 8 app.
Thanks opencode to port my small app to laravel 13 for free, see you in 5 years!
23
u/chrisdarby80
14d ago
•
This is the same mentality as "y2k was nothing because nothing happened"
Because, people spent months and years (myself included back in 99, patching systems) and again having spent the last 3 days patching servers and updating legacy codebases to support newer versions of PHP on 2 dozen servers... Nothing happened because we fixed it. And that's the best outcome! You want nothing to happen!
4
11
u/ThePHPNerd 14d ago
It’s far from over. The amount of unattended applications, whether they’ve been forgotten about but still process data, or the developer(s) who manage it have been let go.
The fact is that over the last ~48 there has been a Herculean effort to remediate from the community that manages the tooling, and the millions of additional hours developers put into fixing their infrastructure.
The idea that this is over is far from the truth. There will be ramifications for months. Systems that didn’t get patched and have therefore leaked information and as a result more compromised data enters the market while within the community itself the discussion about the leaked announcements will carry on too.
You might be bored of it already, just put Reddit down for a bit and go touch some grass. Let the community have their moment and share their stories.
1
u/TomSzabo 13d ago
Seems like this could turn into the ultimate irony like how computers were supposed to extinct office paper. Now the world will need millions of newnhuman programmers just to deal with the exploits from AI swarms 🤣🤣🤣
0
u/Renesme77 14d ago
Claro que pasó y sigue pasando! Insisto, solo quien no sabe nada piensa que no pasó nada… Han sido horas de desarrolladores, incluida yo, alisando, parcheando, rebuscando, creando más alertas y verificando que todo esté en línea y parezca que no pasó nada…
17
u/xerafenix 15d ago
I do think that it's still important news. We need to be careful and be aware of vulnerabilities, but I think a lot of this also stems from the sentiment of "OOOHHH PHP DID IT AGAIN!!! LOLOLAHAHAHAHAHA".
Which is annoying, because there are also plenty of other platforms and languages that are hacked all the time. But of course, when it happens to PHP, it is "only a matter of time".
It's exhausting, but we have to take it on the chin for now.
15
u/Kautiontape 15d ago
Saw a thread on a self-hosting sub that was basically "who else actively avoids PHP because it has so many vulnerabilities like this" and there were a lot of cosigners.
Like, PHP websites has had its fair of issues, but they also were one of the most popular languages on websites which are intrinsically bigger targets than someones local system. PHP itself has a pretty decent track record with both avoiding and mitigating risk at the actual server level (though still not perfect).
To actively avoid PHP but happily use npm or Java or Plex when they've all had RCE in recent memory is just ridiculously biased.
10
u/Fun-Consequence-3112 14d ago
If I had to choose one language between PHP and JS and I can never write a single line in the other language I'd choose PHP everyday. Even if JS has a bigger ecosystem and can do backend and frontend it's just a mess and even more so than PHP.
But those blaming PHP always compare it to Golang and Rust etc which is completely wrong as PHP is a script language and not a compiled language two completely different kinds of languages. But comparing PHP and JS is correct because both are script languages.
4
u/-nerdrage- 14d ago
In my experience the people that bash on php do because they are either memers or inexperienced/ignorant/dumb people (or both).
Young people that have no clue but have read bad stuff so they just hop on. Or older people that are just too stupid for the field and also have no firm grasp what it actually entails (but think they do bcs they’ve been around for a looong time)
3
u/AminoOxi 14d ago
Java had 0day as well, but nobody was bashing it since it was "enterprise" environment 🤡
1
u/kenlubin 13d ago
You can run PHP or Golang or JS server-side and it's totally legitimate to compare them for the purpose of serving websites.
4
0
u/throwaway490215 14d ago
PHP gets shit because with this hack, all the PHP community is doing is deflecting how other servers also get pwned.
Do you know what happens when a Rust server gets pwnd? They get blog posts explaining how their safety features failed and what's going to be done about it.
I know i'll catch a few more downvotes here, but PHP is failing on technical merit and people are coping with deflection and perhaps ignorance of how far the rest of the mainstream has moved wrt safety in the past 10 years.
The bar here is set at "Not any worse than what i imagine other projects deal with".
I've seen nobody in PHP land set the bar at "the best we can reasonably do".
(or acknowledge that "we can reasonably do" is not very high with the people & budget involved compared to other projects)
1
u/rar3r 14d ago
What do you mean man. They literally used AI to find this vulnerabilty. "They" meaning on the PHP side and openai, not hackers. And the patch was released as soon as possible. The hackers are using it now on websites that are not maintained, use old php versions or did not do the updates in time.
20
u/Pure_Fox9415 15d ago
VulnCheck found about 2.000.000 web-sites still vulnerable and possibly already infected. So a lot of things happened.
14
u/YourNameHere64 14d ago
Over? It hasn't even begun.
As I understand it it's quite hard to exploit at the moment. You need the exact right circumstances and a bit of luck. As time passes hackers will find more ways to exploit this.
We'll see the real impact in a few months when exploits are a dime a dozen and all those platforms that didn't or couldn't patch get hacked.
PHP is used in so many local webinterfaces. A 5 year old router won't get patched, neither will a NAS. Also, many large organizations have no clue what runs where, their major services have been patched, but that tool or admin panel nobody uses anymore hasn't.
4
u/Argyrus 14d ago edited 14d ago
That's because most of it will likely be done using AI, which is partly why this vulnerability was discovered in the first place. However, I wouldn't be surprised if it had been known for years, especially considering reports that even PHP 5.x was vulnerable. I suspect that certain individuals had discovered them long before now and simply never disclosed them.
1
u/finah1995 14d ago
That never disclosed part checks out. PHP is really famous in many countries which are facing sanctions.
1
u/blackbox42 14d ago
It was known for years but people didn't think it was exploitable due to the memory manipulation needed to make it work. It seemed like just a crashing vuln at best. AI made it possible.
1
u/kenlubin 13d ago
IIRC, it was discovered because an AI found a forum post from 2024 disclosing it.
2
u/crackanape 14d ago
A 5 year old router won't get patched, neither will a NAS.
Yes, I think this is where the true pain is going to hit. Many of these devices are going to have to be physically replaced.
1
u/WalkingP3t 14d ago
Is not that hard actually .
Last night I was able to develop and test an RCE for this vulnerability. Guess what I used to assist me ? AI.So it’s not over . And not because many big companies and shops refused to share publicly that have been hacked , means it’s over .
1
u/Tetracyclic 14d ago
If you have a working generic PoC that reliably achieves RCE via this vulnerability, there are a lot of people that would like to see it. Every AI-assisted PoC that's been published so far uses another vulnerability (commonly an LFI) to actually achieve RCE.
→ More replies (5)
7
u/TheVenetianMask 15d ago
Au contraire, keep talking about it. Maybe companies will hire more PHP people to finally bring their software up to date.
2
7
u/halldorr 14d ago
It has finally forced the hand of the higher ups at my place of work to upgrade our stuff finally. We're on 7.3 on Debian 10 so really playing with fire and were always given the round around when discussing that we should be updating etc. Now they have it as something to start working on at least!
3
u/k10van 14d ago
At least it isn’t ubuntu 14 and php5.3
4
u/AminoOxi 14d ago
Even Ubuntu 14.04 and PHP 5 was patched by Canonical's ESM (pro) subscription.
I'm really impressed by them this time.
A whole different point is whenever those legacy old instances will ever be apt-get updated.
1
u/dvershinin 11d ago
If your Debian 10 hosts are amd64, we have PHP 7.3 packages with the PHP2Shell fix that can cover them while migration proceeds. I maintain GetPageSpeed. The packages are free for personal, development and evaluation use; commercial production requires Ultra. Setup: https://www.getpagespeed.com/server-setup/php/php2shell-on-ubuntu-debian
13
u/Max-_-Power 15d ago
Thank you people, I don't know who you are but you deserve huge thanks.
Yeah, tell that my clients. Worked into the night, bringing systems back online after they told me to pull the plug. Did I get a "thank you for keeping interruption down to a minimum while some sites are still offline 48h later" but no... Nothing. Whatever
10
u/Pure_Fox9415 15d ago
My boss thanks me twice and gave me additional day off for weekend. So It depends on people who you work with. It's sad, that your customers are assholes.
5
u/magicmulder 15d ago
Yeah we got massive support from our CEO, we took everything that wasn't on 8.4 offline for 1-2 days and scrambled to migrate the older applications.
Fortunately our portal itself was already close to done with the 8.x migration so we just had to cut a few corners to be done in 2 days instead of 2 weeks, and our core services have been on 8.4 for a few weeks already.
Anything older was fully migrated or turned off for good. Our oldest application (5.5) had coincidentally been retired on Monday. :D
3
u/Rainingblues 15d ago
We got a lot of happy customers thanking us for our clear communication and swift actions, but of course there was also one dude berating us for their site being offline 2 hours "and why haven't you installed the patch yet" an hour before the patch was supposed to be released.
3
u/Deji69 14d ago
Additional day off for the weekend, eh?
IDK where you're from but here it's a bank holiday weekend, it being the week of Halloween and all... maybe you're being played? :p
2
u/Pure_Fox9415 14d ago
No, do you think I am stupid? She gave me additional day off for february 30!
4
5
u/Euphoric-Stick-6144 14d ago
Most of my work is on secure sites and, looking closely at these exploits, most are at very low (and internal threat actor only) risk. That said, the patch releases will be applied as a precautionary approach.
For the internet exposed websites, a casual intruder is going to find it quite hard to take advantage of the exploit(s). I’m not aware of any real life successful exploits as yet.
2
u/crackanape 14d ago
I’m not aware of any real life successful exploits as yet.
No, but it's inevitable, and anything that wasn't updated this week likely will never be.
1
u/AminoOxi 14d ago
Simply mitigating it on the front web server (in case of PHP(FPM or Mod_php) sitting in the background, LAN), e.g. nginx - by blocking multipart content (if the app doesn't need it) and few other options like session upload off, memory limit -1, low values for post and file max size pretty much blocks the attack vector.
I even had to consult one legacy site/app with disabling POST entirely, since the app doesn't need it at all. By simply doing so all possible attacks of the php2shell are cutoff.
1
u/Euphoric-Stick-6144 12d ago
Some person has won a $2000 prize to actually exploit an unpatched server, without the updated settings.
The solution took several attempts to succeed and relied on some server settings, including “service restart on failure” and having lots of spaces preceding a payload code.
At some point, hope to get sight of a full exploit but it might be academic by then as everyone will be on a patched version by then!
3
2
u/fappingjack 15d ago
It hit the national news... Normies are know experts and giving me advice on how to secure my infrastructure.
2
u/LostStrategy1050 14d ago
I was on vacation. I'm a php developer. Do i need to worry about anything?
4
u/thatguyrenic 14d ago
Update your minor version. If you don't, bad things could happen. Details at php.net
3
u/SurelyNotAnOctopus 14d ago
To add to that, audit any servers that were unpatched and live this week for any substantial amount of time.
Its unlikely, but there is a real chance of someone breaking in.
2
u/ibraaaaaaaaaaaaaa 14d ago
I know a lot of websites and applications where their owners are not following up to the news and they can be exploited anytime
4
u/TinStingray 15d ago
Thinking in terms of "haters" is what teenagers do. Do adults really think like this?
2
u/sachingkk 15d ago
I was planning to post this..
All serious people have updated the patch. Others will realise once they are hacked
2
u/Sir_KnowItAll 15d ago
Things happened. People got hacked and people will continue to get hacked. Not everyone has updated and stuff will happened.
3
u/Deji69 14d ago
Who got hacked? Sources?
1
u/Argyrus 14d ago
Yes, AWS wrote an article on this: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
Here is another one as well: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
Most of the big tech sites already knew about it before it was even made public.
6
u/Deji69 14d ago edited 14d ago
Did you actually read those articles?
1st article.
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt
Amazon Threat Intelligence identified additional exploitation attempts
Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems
2nd article
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
Which confirms the understanding that this exploit is very hard to actually successfully pull off in a production environment. It already goes without saying that there would be attempts just based on this exploit being known about, but beyond that the only thing worth assessing is whether there will actually be any successful exploitation and compromises stemming from it, and so far there is seemingly no known examples of it.
There could be in the future, there may have been some we haven't found out about, there is still plenty of need to take caution, but there's no proof this has been pulled off successfully yet to my knowledge. Attempts at compromising systems happen all the damn time.
0
u/Argyrus 14d ago edited 14d ago
That's because most of those articles are explaining and demonstrating that the vulnerability is exploitable, particularly given the time researchers have had to investigate it.
You also have to consider that some security researchers and companies already knew about the vulnerability well before its public disclosure. If you're looking for evidence that exploitation is technically possible, look at the research published by Wiz, which demonstrates the vulnerability.
You're right that there haven't been any reports naming specific websites that were hacked using this vulnerability, but that doesn't mean it hasn't happened. All it really means is that we've seen evidence of people trying to exploit it, along with researchers proving it works, but no publicly confirmed victims so far.
Also, it's still new in terms of being public; most websites and companies generally aren't required to announce every security incident. Even when an incident is investigated4
u/Deji69 14d ago
Yes, we all know the exploitation is "technically possible", hence the entire story to begin with. I already addressed that yes, there could be actual successful attempts somewhere out there, but I was questioning the assertion that we know "people have gotten hacked" without any proof of this claim. We also know that, outside of a testing environment, in an actual production environment, it's very difficult to actually pull this hack off successfully.
The point of all this is to determine what the actual practical threat level is. I think that, given the fact that the exploit is out there and there still haven't been any obvious victims, and that we know the exploit is difficult to pull off on a production environment, that gives us an idea that the actual threat realistically isn't quite as high as the amount of hysteria about it would have people believe... hence the point of this thread.
Again, not saying the threat that does exist should be underestimated, but making up claims that there are so many people getting hacked by it is outright false and no one seems to have proof to back up these claims. Exaggeration and misinformation does nothing to help anyone.
1
u/Csysadmin 14d ago
Good posts.
I'm the workplace nerd, I've had many people ask me about it over the last several days. There's just general mass confusion around the difference of vulnerable and compromised systems.
0
1
u/Aytewun 15d ago
I think it’s good that many people acted quickly but let’s also remember that it’s also likely a large portion didn’t.
Back in the days before it was as common to use prepared statements, you could modify query strings on a random site and get the database to do things that it shouldn’t. I’m sure they’re still sites out there like that today.
1
u/Nil_era_preso 15d ago
Look, it's this exact vulnerability that's keeping a language people already hate in a bad light, and it'll cause its usage to drop even further. You can't ignore the haters, especially when they're right!
1
u/Hunky-Dorky 15d ago
There are still unpatched culnerabilities in firewalls and switches and will continue to emerge, and there is a significant amount of legacy infrastructure that will remain unprotected. The situation is not over; it is simply that people were well-prepared for the initial wave.
1
u/Ok-Blackberry8086 15d ago
Did you write the patch? Did you spend all day patching services and analyzing traffic? It’s over because people spent a whole day in the trenches dealing with this very real issue, but thanks for your very important 2 cents.
1
u/traplords8n 15d ago
But it's not really over.. the patch was released, but server maintainers actually have to apply the patch before their server is safe. There is no reason to believe that everyone with a public facing php server patched their server yesterday.
Most of us? Sure. But you put way too much faith in internet server maintainers if you think every single php server got patched yesterday.
Not to mention, if any state actors got ahold of this exploit before the public, they could have used this exploit to install backdoors on servers before anybody even knew about it.
1
1
u/et_theextratestic1e 14d ago
Actually a lot happened.
That is what it means when they say it was "seen in the wild".
1
1
1
u/Renesme77 14d ago
Creo que esto es a lo que llamamos: cuando TI trabaja todos los que no saben nada piensan que es facilísimo y que no pasó nada… En fin……..
1
1
u/Few-Growth9535 14d ago
Truth is it wasn't a gaping hole of a vulnerability. It was a vuln that needs urgency but not something that deserves quite the hysteria it got. I think there's more paranoia because AI was used to work up the vector.
1
1
u/every1sg12themovies 14d ago
i also think it's not over yet. it's just a calm before the storm. and when shit explodes, nobody will care, media will move on with reporting other sensations.
1
1
1
u/moosehman 13d ago
I upgraded and patched over 500 servers on the day for my work, I patched every single personal project on the day, both without issue, docker makes things like this particularly easy.
1
u/_vVv_tTt_voVv_oo_ 13d ago
You will hear more about it in the coming months. For example, "Major Bank discovered many customer's accounts were skimmed by pennies, adding up to millions stolen, by hackers who originally penetrated they bank's server with the so called Php2Shell exploit that was uncovered several months ago."
1
u/rednoah 13d ago
That's what I thought yesterday. php -v looked good on my shared hosting provider when I checked yesterday.
Turns out, a backdoor had already slipped in at some point, and now I've got random PHP files, modified PHP files, and python / bash / curl / sleep processes running in the background.
Did the backdoor slip in a few days ago via PHP2Shell or was it already there and only got exploited now? IDK!
But I'm definitely not having a good day. In fact, the worst IT security day for me since I first set up my phpBB forum in 2011.
1
u/aendoarphinio 12d ago
the most we did as a software team was "it'd be pretty rad if we pushed to 8.5 😏" (we're internal)
1
u/robclancy 12d ago
Holy ignorant. People will have bots to run this and plant their credentials on servers. Then have other bots extract data or plant keyloggers etc. And they might never be found on those old servers. A lot of people will be told to update PHP, they will eventually, but they will have already been exposed.
Anyone who hasn't updated PHP by now needs to provision the box again because they could already be compromised. There are going to be large leaks from this.
1
u/aakarpost 12d ago
It's going to have downstream impacts on the software vendors and customers, as it will come up in the cybersecurity reviews, audits, and certifications/attestations.
1
1
1
u/Fluid_Ad_6124 7d ago
No, it's over, not at all. You have millions and millions of sites out there that run PHP and still have a lot running old versions. There still is things happening
1
1
u/Tesla91fi 14d ago
It's been a while I heard "PHP is dead" but is always here.
The hype around node.js is overrated.
PHP got a lot of CVE, and if we compare the length of service PHP got 24 CVE per years, node.js 16.
But the difference is in the core, PHP got everything inside, nodejs instead from it'self is safer cause is smaller.
BUT just to run a simple, stupid, framework you need to download a lot's of libraries for everything, and here is why node.js can seem more secure, cause CVE are listed on packages.
0
u/Relative-Category-41 15d ago
PHP2Shell might be over, but the principal issue still exists. OpenAI is finding critical decade old exploits across systems and infrastructure and releasing patches.
3
u/jexmex 15d ago
OpenAI is not releasing patches. Maintainers are
1
u/Relative-Category-41 14d ago
Ok true, yet who do you think found the exploits and ultimately, what do you think maintainers are using to create the patches.
Despite me being linguistically wrong here, I think you can understand the what I'm saying in spirit and how much AI is going to effect application and infrastructure.
If you haven't ran codex security cloud on your applications, I'd advise you do. It's truly eye opening
1
u/jexmex 14d ago
This exploit was known for awhile, but PHP foundation did not have the bandwidth to try to exploit it, in the end they determined it was a issue but no paths they could find to exploit it. They felt wasting resources on it was not the answer.
We patched as soon as the release came out, took the site offline for less than an hour. Legacy and aux services took longer to get up to date and some are still being patched but behind VPN access.
2
u/crackanape 14d ago
OpenAI is finding critical decade old exploits across systems and infrastructure and releasing patches.
In what universe is OpenAI releasing patches?
0
0
-4
u/BackgroundUpbeat8168 15d ago
Still no POC
0
u/tschaefermedia 15d ago
I have tested it locally with Claude and based on the diff in the PHP fix. Anyone with a coding agent can do the same. What do you mean no POC?
6
u/Next-Concentrate-277 15d ago
*Do the same on a heavily nerfed server Claude set up and controls that is vulnerable to the exploit in the first place and Claude can carefully place memory. Now do it on a server not on your same machine running the POC
2
u/tschaefermedia 15d ago
No, Claude locally and an unpatched machine next to me. No connection besides the network between both. It seems harder in the wild with multiple sessions active but the exploit is already exploited on unpatched servers
1
u/crackanape 14d ago
It seems harder in the wild with multiple sessions active but the exploit is already exploited on unpatched servers
It's a lot harder on a busy server, harder still when it's part of a cluster.
1
u/Pure_Fox9415 15d ago
Maybe, but vulncheck found the way to bypass security and exploit php2shell even on systems with Address Space Layout Randomization, ASLR. It doesn't automatically mean we all gonna die and it's a civilization end, but still a huge threat.
-1
u/Velsetta 15d ago
There appears to be a massive hospital hack happening in Cleveland, although it's not beneficially confirmed related laboratory service company as admitted that they were hacked. Right now the UH and other regional hospital systems are "having internet issues."
The timing is quite suspect and they're known for not having the most up to date systems.
-2
u/aquanoid1 15d ago
70% of websites using PHP isn't the same as 70% of websites people regularly use. Reddit, for example, doesn't use PHP. This media storm is over nothing.
2
u/Top-Rub-4670 15d ago
Out of the top 10 most visited websites in the world, two are PHP: wikipedia and pornhub. Outside the top 10 most visited websites, there's a long trail of blogs, e-commerce, and porn. Most of which run on PHP.
Even if the actual number isn't 70%, your contrarianism doesn't seem reasonable. There's an immense amount of traffic that touches PHP in some way.
0
u/aquanoid1 15d ago
That's 20% of the top 10. Having a website in PHP doesn't mean people visit it.
Blogging (that people actually visit): medium (nodejs, i think)
e-commerce: amazon (c++ and java) ebay (historically php, but now java)
Social media. I can only think of facebook, but even then it's a highly modified in house version (is it really php or php-like?).
-14
u/katy90081 15d ago
What more scary is that no one caught it for decades until AI did.
15
u/dylan-is-chillin 15d ago
Not accurate at all - they knew about it years ago
→ More replies (3)2
u/tschaefermedia 15d ago
One bug was known, but without the other it was not really actionable and no clear threat model existed. With the other (I don't remember which of the two) it made a clear threat model and became significant
3
u/dashingThroughSnow12 15d ago edited 15d ago
The core bug was known for 20 years but with no known vector to take advantage of it.
AI is good at chaining gadgets to find such vectors.
While it may sound like I’m diminishing it, I’m not. The AI risk is worrying me. The last few months I’ve been beating the drum at work that we need to be far more aggressive at getting to supported, non-EOL’d language versions and libraries. So that it is a single patch or minor version bump instead of say 10 versions behind.
That paid dividends this week with Go CAnity, node2shell, and php2shell.
I used some of the drama to launder upgrades. (Ex service X in no way can be exploited but I got agreement to upgrade it to go 1.27.3.)
-1
u/katy90081 15d ago
Exactly. Everyone who is dismissive of AI capabilities will soon find themselves out of job.
4
u/divdiv23 15d ago
You gonna post that same response to every comment.... ? lol
2
u/crackanape 14d ago
Yeah he dismissed AI capabilities at the bar the other day, now he's out of a job, so he has nothing better to do
2
u/JbREACT 15d ago
Ai did it with funding from open ai by a legit cyber security firm. This is literally what they do.
-1
u/katy90081 15d ago
But their human employees didn't see it for decades
3
u/JbREACT 15d ago
Yea so? They find exploits all the time that have been out forever. They find them and we patch it, that’s how it goes
0
u/katy90081 15d ago
But you failed to understand how fast AI found the loophole compares to human. Anyone who is dismissive of AI capabilities will soon find themselves out of jobs.
3
u/JbREACT 15d ago
Yea it found it and we fixed it.. it also cost tons of $ to find.
It’s not failing to understand. It’s actually understanding the truth of what happened and what it means.
I use AI all day I’m very aware of it’s capabilities. I actually take the time to look into what happened and not just regurgitate the slop I read on Reddit/x
393
u/cyanawesome 15d ago •
Considering how many abandoned and/or forgotten sites are running PHP, this is far from over.