Websites Down Due to Critical Remote Code Execution PHP Security Vulnerabilities

The PHP Foundation released a patch for two severe remote code execution (RCE) vulnerabilities, along with the recommendation to update immediately.

RCE means that an attacker could execute their own code on your server remotely, essentially granting them full control. The exploit's title, PHP2Shell, gets the idea across.

They say that "all PGP installations serving web requests" are at risk. By some estimates, PHP is used by almost 70% of websites.

The vulnerabilities affect PGP installations going back decades, but PHP only officially supports version 8.2 and later. For anyone running an older version, they say "some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version."

There are no complete recommended mitigations other than updating to the patcher version of PHP. It's recommended to switch to your distribution's PGP packages or build PHP from source in order to get the updates as soon as possible.

Now that the patches are out, attackers can analyze them to find where the vulnerabilities exist in the older code, putting anyone who's not able to update at risk.

PHP actually released a warning ahead of time before the patch was released urging developers to prepare to update as soon as they can and that they can release the update earlier if they see the need.

Cloudflare reported early exploitation ahead of the patch.

The bugs were independently found by researchers at Wiz and Calif. Wiz describes them as "among the most severe vulnerabilities discovered in PGP, and arguably in software history."

Security and compliance consultant Davi Ottenheimer told Wired in an interview "an attacker does not need to know which site they are hitting or even the actual software it runs. They send one crafted upload to any server they can find, and that is the entire attack."

Some sites went down in order to safely update their infrastructure.

Wiz describes how the vulnerability had been present for a decade, but AI helped turn it into a working exploit, allowing a single researcher to complete in a week what would have taken a "world-class team months of work."

Comparisons to the disastrous Log4j vulnerability have been made, but it's hard to compare to the sheer scope a PHP vulnerability of this magnitude has.