See all results

Another PHPocalypse

Well, it's not looking dead to me

2 min read

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet.

In short, if you didn't update your PHP on the 21st, you're in danger.

You can check if you're vulnerable via a self-hosted script or the Brandefense ATLAS checker.

Other light reading in attached links.

Personal Experience

I had only one vulnerable service: Matomo Analytics (and Matomo's reaction to most of their users getting screwed is quite underwhelming). Custom image on a custom PHP distribution.

And even though it's a sad day for the internet, I am quite amused by my OCD paying off:

  • Matomo was inside a rootless container
  • On a rootless container runtime
  • With an isolated network
  • Container had cap_drop and no-new-privileges
  • Separate database and cache
  • All consumers of the analytics script had it locally pinned or used Subresource Integrity
  • CI blocked any attempts by nightly builds to publish an image with an old PHP interpreter

There are some things that definitely need improvement, but overall, it's nice not to be in a panic.

Shameless Plug

Ironically, my second specialization after CI/CD/Platform Engineering is the modernization of PHP applications (I've spent 20 years in PHP-related development).

If you need something pulled out of the 7.x bog, help with fixing modern deployments, or assistance in preventing/minimizing damage in the future, send me an email.

I would also point out that this won't be the last drama of its kind, so embrace it.

Brave new world: people without skills or responsibility wielding one of the most powerful tools in human history.

Related