Fighting PHP Zombies: Speakers Urge Patching to Limit Post-Exploitation Risks

Summary

The speakers discuss how unpatched internet-facing systems could become C2, mail-relay or staging infrastructure. They describe code execution from memory corruption, note lateral movement depends on network configuration, and urge patching.

Key points

• One speaker estimates there may be over 100,000 affected systems online and presents 50% patched as a hypothetical scenario.
• Unpatched systems could be repurposed as C2, mail relays or attack-staging platforms.
• The discussion describes code execution at a memory-corruption level and says it may leave no clear artifact.
• Post-exploitation could include network pivoting and lateral movement; the speakers say the risk depends partly on network configuration and segmentation.
• The speakers urge patching, without identifying a CVE or confirming that systems have been compromised.