PHP2Shell: The Internet Hasn’t Burned Down, but the Danger Isn’t Over

It sounds like a disaster. So far, it isn’t. Of the thousands of alleged exploits on GitHub, most are either broken or assume the server already has another serious vulnerability. Several of them, it turns out, were built with AI models that quietly made the test server vulnerable to prove the point. Working examples exist, but they require PHP to run as an Apache module and the server to accept more incoming data than it has memory for, a combination that isn’t very common. The problem is that a working exploit, however narrow, shows the way. That is often how an exploit that works in the lab becomes one that works in the real world.

What concerns us most at Truesec is what happens once the headlines fade. Full patches are only available for the versions that are still supported, 8.2 through 8.5. For 7.4 through 8.1 there are only minimal source code fixes, and for 7.3 and older there is nothing at all. Hundreds of thousands of such installations are exposed to the Internet. Many will never be updated and may remain vulnerable for years.

Then there are the edge products. Some firewalls, VPN concentrators (Virtual Private Network, VPN) and other network devices use PHP in their web interfaces (an uncomfortable irony for our industry). That risk is now real. At least one of the major firewall vendors has confirmed that its products are vulnerable when features such as remote access portals, VPN login through single sign-on or captive portals for user identification are enabled, and the list of affected versions includes several that no longer receive updates.

These devices are also far more predictable than an ordinary web server: same version, same build configuration, same setup in thousands of locations. That matters. Predictability is exactly what is missing to build a reliable exploit today. And edge devices have for several years been one of the most common ways in for both state actors and ransomware groups.

The Internet hasn’t burned down. This is still no all-clear. Someone will find a simple, reliable way to exploit this. You want the work done before they do.

What we recommend every organization do now:

1. Inventory your exposure. Not just web servers, but also appliances, control panels and software with PHP built in.
2. Update. Where that isn’t possible, isolate the system from the Internet.
3. Investigate whether anything has already happened. Exploitation attempts were seen several days before the vulnerability became public.

We would also use this moment to ask what your protection looks like at the application layer. When patches are delayed, layer 7 rules are what keep attackers out, and that applies even to the vendors of security products themselves. If you already have that protection in place, you have bought yourself time. If you don’t, this is a good week to start that conversation.