PHP Flaws Prompt Global Patching and Calls to Limit Internet Exposure

Summary

Security Now examines two PHP remote-code-execution flaws, their coordinated disclosure, reported exploitation attempts and the challenges of patching exposed and end-of-life systems.

Key points

• The two PHP flaws, collectively called PHP to shell, allow unauthenticated remote code execution, according to the research discussed in the episode.
• Calif reported discovering a flaw using GPT as part of OpenAI’s Patch the Planet initiative; Wiz independently reported both vulnerabilities.
• Volche reported finding PHP on more than 2.6 million internet-facing hosts and estimated that about 1.1 million ran end-of-life branches without an official patched release.
• Researchers reported growing exploitation attempts and the adoption of at least five public exploit kits within a day.
• The PHP Foundation said leaked CVE identifiers and an early proof-of-concept video preceded disclosure, prompting it to move the release forward by one day.
• The discussion recommends applying updates, considering interim protections and removing unnecessary internet exposure; Steve Gibson also suggests temporarily disconnecting vulnerable services when appropriate.