A pair of security vulnerabilities lurking in the PHP web programming language for more than a decade, dubbed PHP2Shell, threatened to take down vast swathes of the internet reliant on the software. Luckily, it didn't, and that's probably a good thing.
In case you missed it — my newsletter subscribers got a head start! — PHP is software that powers some 70% of websites and web servers today. Security researchers found several bugs in PHP in 2024 that were concerning but couldn't be exploited, so they weren't fixed. But thanks to a new group of security researchers and a fresh sprinkling of AI, the team at Calif earlier this year developed working exploits capable of taking out more than two-thirds of the web. Not great!
The researchers disclosed the new findings to The PHP Foundation, which maintains the PHP software, sparking a months-long coordinated disclosure process to get patches to the biggest web hosts. The idea was to get fixes out to the companies that cover the most server space on the internet before patches went out publicly on October 21.
The good news is that the coordinated disclosure embargo largely held, and there was no initial wave of mass-hacks as some (including myself, admittedly) had expected.
But we're not out of the danger zone just yet.
I chatted with Mikah Sargent on TWiT's Tech News Weekly about the PHP-ocalpyse, which still threatens millions of websites and servers that haven't been patched. These bugs also serve as a warning sign to the countless unknown and undiscovered bugs buried in aging software like PHP and others that have sat dormant for years, waiting for someone to pry them open in a way that allows hackers to break in.
Here are some of my main takeaways from the conversation:
- Vulnerability coordinated disclosure worked. Ensuring that patches are rolled out to the biggest internet giants while also not tipping details of the vulnerability to potential attackers is a tricky feat, but the circle of trust likely prevented a bunch of servers getting popped. That said, alot of the internet is still vulnerable and patching will likely go on for some time, thanks to how decentralized and deeply embedded the software is.
- We got lucky. We might not be as much next time. The two PHP bugs were not easy to exploit, which likely hindered the majority of attackers in developing working exploits for so long. Amazon saidthere was some exploitation before the embargo was lifted, suggesting that some highly skilled attackers somehow had a head start — either by stealing details of the bugs or by independently finding them.
- AI is undoubtedly changing hacking and cybersecurity. Jason Koebler at 404 Media hasan excellent blog post on how AI is rapidly speeding up the rate of vulnerability discoveries in both old software and new. The speed at which AI can findand exploit bugs in some of today's most popular software has taken plenty of folks in cybersecurity by surprise (and alarm).
- Open source software like PHP is massively underfunded. Given how ubiquitous and widely used PHP is, thanks to it being free and open source, nonprofits like The PHP Foundation and the open source community more broadly are starved of cash and massively under-funded.Reuters ($) spoke with the foundation recently, which says bug reports are going up but its contributors remain about the same, while big tech giants fail to pay or donate for their share of usage.
Thank you so much for reading ~this week in security~. If you like this article, please share a link on your social media! Reach out with any feedback or comments about this article: this@weekinsecurity.com*.*