Is PHP2Shell the New Normal?

Security researchers at Wiz have discovered a vulnerability and weaponized an exploit in PHP servers. They’ve done a commendable job in discovering the issue, as well as responsibly disclosing it so that defenders have the best possible chance of mitigating and patching quickly. Given the severity, it’s fortunate that white-hat hackers found this first.

Even with optimal disclosure, defenders are still forced into a race; attackers are weaponizing and automating their own versions of the exploit while defenders are identifying affected systems and patching them. Unfortunately, attackers have an asymmetric advantage in this race.

What is PHP2Shell in simple terms?

PHP is a server-side scripting language, commonly used to power web-facing applications or management interfaces.

An attacker can exploit a set of vulnerabilities in the core of PHP to execute their own code on an unpatched server from a public context. That means that an attacker can send a series of well-crafted messages to a server running PHP, and the server’s reaction grants the attacker the ability to take control of the server. This could be used to steal information, destroy IT systems, or as initial access for a coordinated attack like ransomware against an affected organization.

Why is this such a big deal?

PHP2Shell is a worst-case scenario for defenders for two reasons:

1. High applicability: PHP is widely used, powering ~70% of websites, and the vulnerability exists in recent, patchable versions as well as older versions for which a patch will not be available. PHP is common because it is a flexible tool that has been around for a long time. It can be used to power a website that does just about anything.
2. Publicly exploitable: Applications driven by PHP are often accessible from public internet, and the exploit requires no special access or authentication. As a result, the NSA issued guidance to consider mitigating risk by turning systems off until they can be patched; downtime you control is better than downtime you don’t.

In this sense, PHP2Shell is similar in impact and severity as once-every-few-years events like Log4Shell (log4j) and Heartbleed. Although these vulnerabilities differ in their exploitation mechanisms, they share a fundamental characteristic; their widespread deployment transforms an isolated software defect into a worldwide security threat.

What is the significance of this vulnerability?

Simply put: this vulnerability wouldn’t be exploitable at scale without AI assistance. As the researchers who discovered it note, they had to thread a series of needles to turn the vulnerability into a weaponized exploit. So while this would normally be out of reach for many attackers… in the AI era attempted exploits jumped to the millions within a day. Although attempted exploitation does not necessarily indicate successful compromise, these observations expose a fundamental weakness in conventional security strategies. By the time a vulnerability is publicly disclosed, identified within an organization’s infrastructure, and patched, adversaries may already have exploited the opportunity.

While vulnerabilities of this scale and severity are historically rare, it’s also getting harder to see events like this as a “black swan” that can’t be predicted or accounted for. All signs point to a dramatic increase in vulnerabilities and exploits, and PHP2Shell is just another proof point that defenders need to consider how to augment their strategy to account for increasingly-common severe vulnerabilities.

This reality demands a shift in cybersecurity strategy, from an emphasis on preventing intrusion toward containing threats and protecting operational continuity even after an initial compromise.

How can QuellSecure and Containment help?

There’s plenty of guidance on remediation and patching for this specific exploit, and Quell can’t say anything that hasn’t already been said about this specific issue. Instead, look to a defense-in-depth strategy to ensure resilience and operational continuity. If you can no longer reliably prevent the threat because it’s evolving and adapting too quickly, you must look to tools that can contain the damage. An organization can withstand a series of minor issues if they don’t cause downtime, but a single catastrophic incident may be an extinction event.

Quell is focused on ransomware because ransomware’s primary objective is to disrupt operations to inflict pain, and it’s easy to predict ransomware attacks that use PHP2Shell in the coming months. A containment strategy can limit the damage when attacks get through, so that operations always continue. QuellSecure’s Active Containment® technology is designed for exactly this purpose.

‍