- Feature Articles
- CodeSOD
- Error'd
-
Forums
-
Other Articles
- Random Article
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
PHP 7.4, 8.0, 8.2 maybe EOL'd but at least one vendor has back ported the fixes and had them out the same day as the fixes for 8.4 and above in their supported stream.
Admin
official backports for 7.4, 8.0, and 8.1 were released at the same time as the fixes for non-EOL version, albeit only in the form of source code:
Edit Admin
Re: PHP2Shell - exploitation is decidedly non-trivial. Even the "we've seen it in the wild" example was against a very specific configuration, which anyone is unlikely to use. It involves using one type of apache worker, and configured to have a single worker process, not the multiple you'd usually configure (and is the default). Oh, and the artificially limited the OOM limit lower than the default as well.
So, sure, some people might be vulnerable, and an attacker might get things to align between the races involved, the OOM setting, the exact versions of PHP and other libraries etc, but it does seem vanishingly unlikely.
The biggest issue might be with some embedded devices using PHP, and which no longer receive security updates. Someone could hammer away at those with a botnet until they fall through luck.
Admin
What makes the eMudhra situation even worse (for them) is they claimed that their processes were audited and given a pass. Probably a bit like the Cyber Essentials 'audit' where you answer a couple of questions and the only thing stopping you passing is if the cheque bounces...
One thing that stood out for me with the PHP vulnerability was the blind panic it brought about in senior management / board-level. Because they'd heard about it on the news they had to be seen to be doing something and so the IT departments were given even more work to do to show that they were handling the PHP issue - either through patching, mitigations or the fact that they weren't actually using PHP - and that all had to be documented. In triplicate. With a short animated presentation, as we all know senior management are far too important to actually read something and can only respond to traffic light graphics.