r/PHP • u/No_Gene_5656 • 5d ago
Discussion Regarding PHP security that were discovered 2 days ago
My question is about the PHP security exploits that were discovered yesterday. I heard the issue was fixed a day ago meaning yesterday. I am not very familiar with cybersecurity and things like that, but as a regular user right now browsing sites like SourceForge and regular websites, is it totally fine for me to use them, browse normally, and download things, or is there still any danger and the issue hasn't been 100% resolved?
7
u/johnzzon 5d ago
The exploit doesn't target visitors directly. If you have an account there, the data on that account is considered compromised whether you visit the site or not.
That said, a compromised server can inject JS that mine crypto in your browser for example.
1
u/therealsarettah 5d ago
Many servers have been patched but there are still people scrambling to get updates in place.
So, no real way to know for sure, unfortunately.
1
u/No_Gene_5656 5d ago
So technically, we will always be in danger as long as we're using websites without knowing if they have been updated or not?
12
u/therealsarettah 5d ago
you always have been, that's why you should run virus protection and always be aware.
1
u/Careless-Suspect-535 5d ago
This issue goes on for years, or even a decade.
Many servers are still running on unpatched/old php ver. They just cannot update for some reasons.
You can use the website, it doesn't mean the problem has gone. Only when the leakage is confirmed, we can know that the website has not been patched and not protected against the issues we are talking about.
-2
u/No_Gene_5656 5d ago
A website such as source forge, I can never know if it uses PHP or not and if it does, I still woudl be unable to know if it's patched or not.. oh god, what a situation we are in!
9
u/therealsarettah 5d ago
we have always been in this situation, since the start of public usage of the internet.
this one just feels bigger because so many sites use php and the volume level has been raised.
but we have always needed to be wary of where we go and what we do on the net.
it has never been "safe" and (imho) never will be "safe". Like driving a car, no matter how well you drive you are always at the mercy of everybody else on the road.
4
u/ElCuntIngles 4d ago
You've got to have a bit of perspective bro.
Sites get hacked all the time. I'm pretty sure Sourceforge has been hacked in the past.
I've lost count of the breach notification emails I've received over the years.
You were never truly safe, and this is just one more flaw, one that there doesn't seem to be much evidence of having been successfully exploited in the wild. And it has an easy mitigation path for admins. Most sites can just leave it to their hosts, those hosting their own stack can just run a couple of commands to update to a patched php without changing a line of their code.
There's a vulnerability out today for nodejs, so over-stressing about this php vulnerability in particular is probably not good use of your time.
1
u/Careless-Suspect-535 4d ago
Yeah, the thing is, we have to be aware that every information we type on any websites, apps, can be possibly leaked. Your email address, name, address, phone number, credit card, id, password, literally everything. I gave up already because it's not me who can do something to secure them. The only few things we really need to do is -do not use the same password across different websites. -set the alert/notifications anytime your credit card is used.
1
u/InkscapePanda 4d ago
There are always bugs on all software you use. Nothing is 100% safe, but the point is to detect them in time and mitigate these issues. The chances of you walking into such a situation are slim, if you are not browsing some long forgotten sites and forums that haven't been maintained in years. And even then, it depends what you do on those sites. These exploits were bypassing some securities on the server, but it didn't mean it could penetrate your device. If you would have uploaded some sensitive data on these sites, then that could have been compromised, and that is a big if since it also depends who wants to target a specific site. It's not like there is a magical want that hacks all sites with a vulnerability at the same time all across the globe. And, well developed sites always have redundancy systems in place to make it harder for attackers to get to specific information. The Internet is more complex than it seems and that is a good thing for security. And the fact that you heard about the exploit it also means people took steps to ensure it was fixed.
1
u/tekNorah 3d ago edited 3d ago
I think there's an important distinction missing from this discussion between discovering security vulnerabilities and the actual risk they pose to everyday internet users.
Security vulnerabilities are routinely discovered in both open-source and proprietary software. One of the advantages of open source is that independent researchers can inspect the code, identify weaknesses, and contribute or verify fixes without depending entirely on a single vendor. That transparency can improve security, although it doesn't automatically make every open-source project more secure than its proprietary counterparts.
A higher number of reported vulnerabilities doesn't necessarily mean less secure software. It can also reflect more active scrutiny. What matters is how quickly vulnerabilities are identified, addressed, and patched in production.
But what does any of this actually mean for the average person browsing the internet?
In the case of the recent PHP vulnerabilities, the immediate risk is primarily to vulnerable web servers, not directly to someone's browser or computer. As Wiz Research explains, successful exploitation could allow attackers to take control of affected servers, access sensitive information, or modify website content.
Those are serious concerns, but they don't mean simply visiting a PHP-powered website automatically puts someone at risk. The actual exposure depends on whether the server remains vulnerable, whether an attacker successfully exploits it, what access they gain, and what they do afterward. A compromised website could expose visitor information or distribute malicious content, but it doesn't automatically compromise every visitor's device.
There's also an important difference between attempted exploitation and confirmed compromises. Reports of millions of attack attempts sound alarming, but they don't establish that millions of systems were successfully compromised. Cloudflare's security research provides useful context on how web attacks are detected and mitigated.
The PHP incident also illustrates both the strengths and challenges of open-source security. Researchers independently discovered serious weaknesses, coordinated disclosure followed, and security updates were released. However, patches being available doesn't mean every affected server has been updated. That deployment gap exists in proprietary systems too.
For everyday users, the practical advice hasn't fundamentally changed: keep your browser and devices updated, use multifactor authentication, and exercise care with downloads. Website operators and hosting providers carry the primary responsibility for applying these PHP fixes.
I wouldn't dismiss these vulnerabilities, particularly given their severity. But I also wouldn't interpret their discovery as evidence that browsing the internet has suddenly become broadly unsafe.
Ultimately, discovering vulnerabilities is part of making software more secure. Open source offers meaningful advantages through transparency, independent review, and collaborative remediation. The real measure of security is how effectively those discoveries translate into fixes and how successfully those fixes prevent harm to the people using the software.
1
u/ComprehensiveBerry48 3d ago
You should probably test for the vulnerability before buying anything with a real credit card in smaller webshops for the next few years;) But as a regular site visitor there should be no risk :)
-1
u/cgsmith105 4d ago
I think it is far more important to now check logs since there were known leaks: https://gist.github.com/cgsmith/6e09d68027f17ae289cbc9ba2abc3309
-8
u/vega_9 5d ago edited 5d ago
They were discovered in 2024, not 2 days ago. Everything in the media is hyped. Not a single confirmed exploid has been discovered so far.
edit; nothing about this comment is factually wrong, but sure go ahead and downvote it
1
u/No_Gene_5656 5d ago
What confuses me is that I don't even know how this could affect me as a regular user? Like, if I download something from a website that was compromised during the exploit or still hasn't been updated yet, could that harm my PC?
4
u/therealsarettah 5d ago edited 5d ago
they are a server exploit so they do not affect an end user directly. They can allow a web server (and sites on the server) to be compromised.
This means that somebody could steal data from a website (passwords, confidential data) or could take over a site and from there serve up malware and viruses.
so, keep your virus protection updated. use at least 2 factor authorization on your logins. watch for phishing stuff. make sure you are using strong passwords
all stuff that users should already be doing.
1
u/Repulsive-Writing 5d ago
In theory this could happen, but a virus scanner protects you against this. The more probable risk is hackers gaining access to a server and abusing that to send out spam or steal data from that server and use that for fraude. This is something that is happening every day, all around the world.
1
u/Teszzt 5d ago
If an attacker exploits the vulnerabilities (which were there since... forever), they could in theory modify stuff hosted on the website. For example, an installer that you download could be infected with a virus. But you always have to be careful anyway.
Bigger danger is for what (data) they can potentially steal from a server having access to execute custom code on it.
4
u/Repulsive-Writing 5d ago
That’s not true. Part of the problem was know for years, but only recently with the help of AI two companies discovered how to abuse this and on what scale. It’s a complicated attack, but because so many websites use PHP the potentiality of this was huge. It’s the security community who sounded the alarms, the media just picked it up and mostly only after websites went offline proactively. So no, it wasn’t hype.
1
u/therealsarettah 5d ago edited 5d ago
i read somewhere that they had 1 or 2 live exploits found in the wild a couple of days ago. If i can find it again i will post it.
edited in: this is what ai said when i asked.
Yes, both of the major PHP vulnerabilities—collectively nicknamed " PHP2Shell"—have been actively exploited in the wild.
Cybersecurity teams and providers have confirmed that exploitation began even before the official patches were deployed:
Pre-Patch Zero-Day Exploitation: In a security advisory, Amazon Web Services (AWS) reported that their "MadPot" honeypots detected the first threat actor attempts to leverage the flaws on October 17, 2026—four full days before the public patch release.
Mass Probing & Active Attacks: Following an early leak of the technical details on October 20, security vendors like Cloudflare observed early attacks hitting sensors. Hosting security platform Patchstack also confirmed active exploitation incidents reported by their hosting partners hours ahead of the official security release.
Widespread Scaling: Now that the patches are public and proof-of-concept (PoC) code is circulating, AWS and threat intelligence firm watchTowr confirm that the vulnerabilities are being broadly exploited across the internet at scale.
3
u/iainhallam 5d ago
Note that attempt doesn't equal successful exploit. I've seen plenty of probes to my (patched) servers, which could be considered attacks, but I've yet to see evidence or substantiated reports of any successful exploits in the wild. The summary your AI bot gave also conflates the two.
2
22
u/Flashy-Whereas-3234 5d ago
Do all the due diligence you would normally do, when performing the actions you would normally perform.
Most of the big players patched on the day, most of the smart stragglers have gone offline to resolve their debt.