Reshare — content from Vincent Strubel
PHP2Shell: watch out for aftershocks
The somewhat chaotic publication of critical vulnerabilities in PHP last week gave rise to a remarkable mobilization, on a global scale, to urgently apply the patches on an incredible number of websites. We can be glad about that.
But we should not too quickly think that the problem is solved: the risk is shifting from websites to the myriad of third-party products that embed versions of PHP (randomly in a web administration interface): routers, firewalls, industrial controllers, connected objects in the broad sense… They too must be updated.
A useful resource to avoid drowning in the complexity of the subject: the initiative of our counterparts 
at the Nationaal Cyber Security Centrum (NCSC-NL), who consolidate in a github repository the available information on updates to products embedding PHP.
This allows us to combine our efforts at least at the European scale, and to avoid duplication of work or information. Bravo and thanks to them! ANSSI now references this repository in its own alert, and injects its own information into the common directory.
Github repository: https://lnkd.in/eXTxysrt
LinkedIn Sources
- Profile: Pierre Jean Duvivier dit Sage (LinkedIn)
- Shared author: Vincent Strubel (LinkedIn)
The post ⚠️ PHP2Shell: watch out for aftershocks appeared first on les plumes qui mordent.
Frequently Asked Questions
FAQs PHP2Shell Beware of Aftershocks
Q What is PHP2Shell
A Its a name for a type of attack where a flaw in PHP code lets an attacker run their own commands on your server often right after a related vulnerability was fixed The aftershocks are followup attacks that hit before or after the first one is patched
Q What does aftershocks mean here
A Its a metaphor from earthquakes After one exploit attackers keep probing for leftover holes missed files or weak patches Those followup hits are the aftershocks and they can be just as damaging
Q Is PHP2Shell a specific CVE or a real product
A No Its a descriptive label not a single vulnerability ID or tool Treat it as a warning pattern a PHP flaw that leads to shell execution plus the followon attacks
Q How does an attacker go from PHP to a shell
A Usually through unsafe input handling for example passing user input to system exec shellexec popen or backticks or through file uploads includerequire with usercontrolled paths or deserialization bugs Once code runs they can spawn a shell
Q Why should I care if I already patched the main bug
A Because aftershocks target what you missed unpatched copies backup files debug endpoints cached code or other services sharing the same credentials A clean patch doesnt undo damage already done
Q What are common warning signs of an attack
A Unexpected outbound connections new or changed files in web directories odd cron jobs unknown users or SSH keys unusual processes and spikes in error logs or 500s
Q How do I check if my app is vulnerable
A Search your code for dangerous functions and see if any take user input Also check file uploads include paths and unserialize calls Run a static analysis tool and a dependency
