PHP2Shell - 2 Devastating Exploits

One of the most devastating attacks on the the internet has ever seen has just taken place. Command AI PHP to shell. Uh, two exploits were revealed in PHP. The the source code that's been in existence for non 20 years now. The reason why this is critical is because like so like we talk about our Nex.js JS websites and our Web Flow websites and stuff like that. Blah blah blah blah blah blah. So much of the web is run by some form of PHP framework. Yeah. WordPress, Drupal. Basically two vulnerabilities here. I know they've got long complicated words, but they are all all rated I think 9.3 and 9.5. These are ratings they get given on how severe they are and how much it affects these things. And it essentially comes down to memory allocation and being able to reuse that memory. So this is all way beyond me. I'm sorry I can't be too detailed with it. But effectively PHP you have to manage the memory of the application. You say I want to use this block of data or this block on the on the memory and when I'm done with it I want to clean that. Now there are certain functions very very basic functions actually that when you say you're going to use this block of data with this particular function when you remove that function because of the way it was written it still thinks that block of memory is being used and people have found a way to flip it and use that block of data to run their own code basically to that's why it's called PHP2 shell they now have shell access based on that little switcheroo that's happening with with the memory. Those what both that's basically what both these um you know uh both these exploits are doing. They're both they're both doing the same thing. So let's try and find something that's not boring cuz I know that was probably a lot to whatever. No, it was actually very interesting the way you explained it. I liked it actually. Basically, if you're running WordPress, Drupal, Joomla, Laravel, Symphony, PHP, FPM deployments, you'll find NGX, I don't know what that is, Apache, which is, you know, a lot of servers are using Apache, light speeded, frank PHP, CGI based PHP servers. It is crazy. And there are patches released for version 8.5, 8.4, 8.3, 8.2. Basically, if you're on anything before 8.1, you just need to update 8.5.2. 12 tonight. And I have a feeling that this was warned by someone. They were like something big's going to drop tomorrow. Like there was a tweet sent out. There was there was a leak. So because this vulnerability was found, I believe in uh August. Okay. Yeah. And then they were working on the patch and then they they wanted to release the the press basically telling everyone, hey, there's a vulnerability and now it's time to update it because like how else do you want to do it? There are like millions and millions of websites using PHP. You cannot like reach out to every person and be like, you know what, there is a vulnerability, let's fix it. You have to release it. But that's kind of like the dangerous thing when you release it. At the same time, you now let a lot of more people know about the vulnerability, but you you got to have a patch in place first. So, they did have the patch. They wanted to release it on the press, but a few days before that, it got leaked. Sure. So, so they had to do the press a day or two earlier to what it was planned. So, everything got in a rush and it kind of like become a bit messy. And another thing that happened, it got into mainstream media, which it it is worth getting into mainstream media because it is actually like very severe and important. But at the same time, I I believe because of all the mess and maybe because not much else was going on, it got like absolutely viral. So basically all the mom and dads of like the the people in the IT would be calling them and like do you know about it? So when your non- techy friends tell you about something, you know that it it is like it has reached that point of virality. I saw [laughter] I saw a tweet by someone um basically they had they had messaged someone they it's levels actually levels io uh he all of he's like a PHP dev all of his stuff everything he makes is on PHP love it or hate it he knows PHP so that's where he built all his stuff but obviously then he that means that he's in a bit of a ring with a lot of other PHP developers he messaged someone to say look at this this is big and the response was something to the effect of I'll look at it in a few days. is I'm out of office at the moment and it's like you do not realize cuz you know we're talking about enter a lot of enterprise is running on PHP again point claude at your your environment your code and ask it is there any are we affected here you know run your audits and understand if you're at all affected by this fun fact in all this I spoke to someone last night that everyone's finger was on the trigger waiting for a patch to be released so what happened was When that patch got released, everything the whole internet just basically grinded and grunted because everyone was updating at the same time. So, the next logical choice is to just take your systems down. Like just just take them down. Yeah. Pause. And and that's what they ended up doing. They just ended up taking a bunch of non-essential services down for everyone else to update the essential services and then start patching as things chilled out a little bit. Don't rely on the uh WFT which is web application firewall or something like that. Like it it's so core like once someone's through like anything like it's just this exploit is so core to web infrastructure and servers. All you need to know is a big deal. This is part of a larger conversation on my show Command AI which we stream live every single week. We discuss the news and all things related to AI in the world of design and web. Catch us next week and join in the banter. Command AI.