- Feature Articles
- CodeSOD
- Error'd
-
Forums
-
Other Articles
- Random Article
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
PHP 7.4, 8.0, 8.2 maybe EOL'd but at least one vendor has back ported the fixes and had them out the same day as the fixes for 8.4 and above in their supported stream.
Admin
official backports for 7.4, 8.0, and 8.1 were released at the same time as the fixes for non-EOL version, albeit only in the form of source code:
Edit Admin
Re: PHP2Shell - exploitation is decidedly non-trivial. Even the "we've seen it in the wild" example was against a very specific configuration, which anyone is unlikely to use. It involves using one type of apache worker, and configured to have a single worker process, not the multiple you'd usually configure (and is the default). Oh, and the artificially limited the OOM limit lower than the default as well.
So, sure, some people might be vulnerable, and an attacker might get things to align between the races involved, the OOM setting, the exact versions of PHP and other libraries etc, but it does seem vanishingly unlikely.
The biggest issue might be with some embedded devices using PHP, and which no longer receive security updates. Someone could hammer away at those with a botnet until they fall through luck.