US cyber agency confirms PHP2Shell break-ins as millions of servers may remain exposed
A week after patches for two critical PHP flaws, there is evidence of successful intrusions; US federal agencies have three days to update.
The US cyber agency CISA on Monday added the two PHP2Shell flaws in PHP to its list of actively exploited vulnerabilities, TechCrunch reports. Civilian federal agencies must update their systems within three days. CISA did not say who the attackers are.
Heise describes how a security researcher running decoy servers saw attacks actually succeed: 35 shells were launched on three servers running PHP 8.4.26, from two IP addresses. Security firm Censys on Tuesday still counted more than 4 million services with a vulnerable PHP version number in Germany alone, although that figure may be inflated because some Linux distributions backport patches into older versions.
The flaws let attackers run code over the internet without a password. Some governments and large companies temporarily took their sites offline to patch, TechCrunch writes. Heise advises installing the emergency patch immediately and then moving to a current PHP version.