Why Identity Blast Radius Matters More Than CVSS After PHP2Shell
Summary
Sponsored analysis argues that patching cannot always outpace exploitation and recommends limiting the access of service accounts and AI agents to reduce the impact of a compromised workload.
Key points
- The article says two PHP remote code execution flaws, present since 2012, were found by researchers at Calif and Wiz with help from AI models.
- It reports an exploitation attempt on October 17, before disclosure, and further attempts on the October 21 patch date; CISA added both flaws to its known exploited vulnerabilities list on October 26.
- The article cites Censys as counting 32.5 million internet-facing PHP services running potentially vulnerable versions as of October 27, plus more than 60 million services that did not report a version.
- A compromised PHP workload may expose environment variables, cloud keys, and worker memory containing passwords, tokens, or API keys.
- The article describes a LiteLLM incident in which attackers reportedly used an exposed master key to obtain a GitHub organization-owner token and publish credential-stealing artifacts.
- It recommends inventorying AI agents and non-human identities, assigning owners, limiting access to intended purposes, removing dormant credentials, and governing identity lifecycles.
Article Details
- Topic
- PHP2Shell exploitation and reducing post-exploitation impact by limiting identity access and blast radius.
MITRE ATT&CK
Products
GitHubAt LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform.LiteLLMAt LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform.PHPThe two flaws behind PHP2Shell had been in PHP's code since 2012.