Censys: PHP2Shell Highlights the Challenge of Maintaining Vulnerable Software
Summary
Censys reports that more than 11 million PHP services moved to fixed versions after PHP2Shell patches became available, while over 30 million still reported affected versions as of October 29. Its research also found that the oldest enterprise software changes little.
Key points
- The article says AI is lowering the cost and expertise needed to turn obscure vulnerabilities into working exploits, though more vulnerability disclosures do not automatically mean greater risk.
- Censys observed over 11 million PHP services move from affected to fixed versions between the October 21 patch release and October 29.
- More than 30 million PHP services still reported affected versions; roughly 23 million were running PHP 8.1 or older, for which the article says no official PHP2Shell fixed release was available.
- Censys tracked Telerik Report Server, Jenkins, Cleo Managed File Transfer, and SharePoint over two and a half years; the oldest releases, 8 to over 20 years out of date, changed by only about one percentage point of their population.
- Censys observed contrasting update patterns: Jenkins had a steady upgrade rate, while Cleo MFT upgrades surged after reports of active exploitation.
- The article argues that reliable migration paths, backward compatibility, asset visibility, and maintainable update processes help organizations deploy security fixes and manage legacy systems.
Article Details
- Topic
- PHP2Shell patch response, legacy software maintenance, and the challenges of keeping Internet-facing systems secure
People
Vendors
CloudLinuxAn interesting other example is vendors like CloudLinux and Plesk that have backported fixes to older PHP branches, sometimes without changing the reported upstream version, so that users don’t even need to moveDanfossWe saw this play out with the recent Danfoss refrigeration controller hacks, which affected both newer systems with outdated firmware and older models that no longer received security updates, leaving operators of thosePleskAn interesting other example is vendors like CloudLinux and Plesk that have backported fixes to older PHP branches, sometimes without changing the reported upstream version, so that users don’t even need to moveVertexITOne provider, VertexIT, reported applying patched packages within two minutes of their availability, without outages.
Products
PHPyou have been off-grid the past couple weeks, here’s a short recap: two critical memory-corruption bugs in PHP were disclosed that could allow an unauthenticated remote attacker to gain code execution on PHP webWordPressSome run PHP directly, while others rely on hosting providers or applications like WordPress, where the underlying PHP runtime is managed separately.