PHP2Shell: what the October PHP scare means for your website (and what to ask your web host)

On October 21, the PHP project shipped emergency fixes for two critical security flaws nicknamed PHP2Shell. PHP runs most of the web, including nearly every WordPress site, so if your business has a website, this one is worth five minutes of your time.

What happened

PHP is the programming language behind a huge share of websites, from WordPress and Joomla to online shops and custom business tools. Researchers at Calif, OpenAI and Wiz found two bugs in the core of PHP that had been hiding for years. Both involve PHP leaving its memory in a broken state when a web request ends badly, for example when the server runs out of memory partway through.

An attacker who sends the right kind of request can turn that broken memory into a way to run their own commands on the server. No password is needed. From there they could plant a hidden back door, steal database passwords and keys, deface the site, tamper with checkout pages or move deeper into a company network.

Why it was a scare

• Attacks started early. Amazon says its decoy servers saw an exploit attempt on October 17, four days before the fix came out. Cloudflare also reported early attacks.
• Details leaked. Word of the flaws spread on social media before the planned release, so the PHP team released its fixes a day early.
• It touches almost everything. Every common way of running PHP on a web server is affected. Setups using Apache with mod_php are at the highest risk.
• Lots of servers run old PHP. Security firm Bitsight found that only about a third of the PHP servers it could identify run a version that received this update. The most common version it saw, PHP 7.4, is years out of support.

Is my website affected?

If your site runs on PHP, it was affected until it was updated. That includes WordPress, WooCommerce, Joomla, Drupal and many custom sites. Firewalls, security plugins and changes to your website itself don’t fix this. The only real fix is updating PHP on the server.

Most small businesses don’t manage their own server. Your web host or web designer does. So the job for you is simple: ask them.

What to ask your web host or web designer

• “Is our site’s PHP updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer?”
• “If we’re on PHP 8.1 or older, when are we moving to a supported version?” Those versions don’t get regular fixes anymore.
• “Did you check the running version, not just the installed package?” A server can have the update installed but still be running the old version until it restarts.
• “Have you checked for signs we were attacked before the update?” Because attacks started before the fix, look for unknown admin accounts, new files and odd changes.

If your site sits behind Cloudflare, it has had some extra protection since the flaws were announced. Cloudflare says that protection is temporary and doesn’t replace the update.

Don’t forget the less obvious places

PHP also runs inside some routers, firewalls, storage boxes and control panels. Palo Alto Networks has confirmed its firewall software is affected, and other vendors were still checking at the time of writing. If you have network equipment with a web dashboard, check the vendor’s security page for updates.

Our take

We patched every system we run on October 21 and 23. The lesson for small businesses isn’t to panic. It’s to know who is responsible for updating your website and equipment, and to make sure they actually do it. If nobody can answer that question, that’s the real problem to fix.

Need a hand with this at home or at work? HD Technologies sets up, secures and supports Wi-Fi, computers, cameras and networks for homes and small businesses. Email us at [email protected].

Sources: BleepingComputer, Bitsight, Help Net Security.