PHP2Shell Patch Risks and Modern Incident Response Discussed on Security Weekly
· 2:09:19 · Watch on YouTube ↗
Summary
Joshua Wright discusses a free incident response book, while the panel examines PHP2Shell patching, third-party response delays, weak TLS keys and reported pre-authentication flaws in Broadcom wireless drivers.
Key points
- Joshua Wright describes a 700-page, SANS Institute-sponsored incident response book offered free digitally under Creative Commons, combining operational guidance with composite incident narratives.
- Wright emphasizes communication, executive reporting and collaboration alongside forensic skills, with human review remaining essential when using AI to assist writing or coding.
- The panel reports that patches are available for critical remotely exploitable PHP flaws, warns that PHP offers no complete workaround and recommends checking deployed runtime versions.
- Participants describe WAF protections as temporary barriers rather than substitutes for patching, and warn that publicly posted exploit proofs of concept may be nonfunctional or malicious.
- The discussion highlights hidden PHP dependencies, hosting-provider patch delays and the need to combine inventories with response planning, business prioritization and rapid execution.
- The panel discusses eight reportedly compromised TLS certificates with unusually small private-key spaces and the operational challenge of coordinating trust-store changes.
- Participants describe research into Broadcom wireless-driver WPS preprocessing flaws reportedly enabling code execution without network authentication; the effectiveness of disabling WPS remains unclear.
Article Details
- Topics
- [03:43] Distinguishing threat hunting, incident response and digital forensics
- [07:59] Communication, leadership and collaboration in incident response
- [12:44] AI-assisted coding and the continuing role of technical judgment
- [16:23] AI assistance and human review in incident response writing
- [19:48] A free Creative Commons incident response book and its intended audience
- [32:10] PHP2Shell exposure, patching and limits of temporary mitigations
- [49:25] Third-party dependencies, inventories and response planning
- [01:04:20] Weak TLS private keys and coordinated certificate-trust response
- [01:09:05] Reported Broadcom WPS preprocessing flaws and disclosure concerns
People
Josh MarpetPanelist who discusses response capacity, software and AI inventories, and blast-radius planning.Joshua WrightSANS faculty fellow and senior director with Counter Hack Innovations who discusses incident response practice and authorship of a free, Creative Commons incident response book.Larry PescePanelist who explains reported Broadcom WPS preprocessing research, unauthenticated wireless exposure and disclosure concerns.Lee NeelyPanelist who highlights hosting-provider patch delays and third-party dependencies in incident response planning.Paul AsadorianHost who presents his assessment of PHP exposure in network-edge appliances and discusses patching, mitigation and response readiness.QuentinResearcher identified by first name whose reported AI-assisted Broadcom WPS preprocessing research and coordinated disclosure are discussed by the panel.Rob T. LeeSANS Institute representative whom Wright credits with requesting a reboot of the incident response step-by-step book series.Stefan EsserResearcher credited in the panel's discussion with discovering historical PHP problems in 2004.Stephen NorthcuttContributor to the original incident response book series and Wright's mentor, whose blessing Wright sought for the new project.
Vendors
Broadcom[01:09:33] on a whole bunch of Broadcom chipsets.Citrix[34:26] F5, Citrix NetScaler, Palo Alto PAN-OSDreamHost[42:28] >> DreamHost already patched everything IF5[34:26] F5, Citrix NetScaler, Palo Alto PAN-OSJuniper Networks[34:36] Juniper all have affected or potentiallyPalo Alto Networks[34:26] F5, Citrix NetScaler, Palo Alto PAN-OS