More bugs out there: PHP2Shell is just the start

On Wednesday, it was publicly disclosed that two flaws had been found in PHP (PHP: Hypertext Preprocessor), the language that builds a web page on the server before your browser sees it. Web content management system WordPress runs on it, as do many GoI portals, bank sites and online shops — some 7 in 10 websites.

It was written in the early 90s, and a lot of it hasn’t been looked at properly since.

The two bugs found, ‘PHP2Shell’, live in the bit of PHP that handles a crash. Run out of memory at the wrong moment and PHP lets go of a chunk of memory while still remembering where it was. The next request that lands on that server can walk straight through the gap. And because this happens inside PHP, before a single line of your own code runs, nothing you built on top matters — not your login page, not your firewall rules. The server is simply open.

ET Bureau

US-based AI security firm Calif found the first bug in August. A model from OpenAI did most of the work, during an audit OpenAI paid for. Two weeks later, Wiz, the cloud security company Google bought, found both on its own, also with AI. Both firms said the same thing: bugs had been there for more than a decade, and a human would have found it brutally hard to turn them into a real attack. A researcher at Wiz is said to have done in a week what a top team would once have needed months for.

And that’s where the whole story lies. For 30 years, the internet has run on code nobody read. That was fine, because nobody had time to attack it either. Finding a bug this deep took a rare kind of person and patience. So, old code stayed broken, and nobody paid for it. That deal is now over. The models that found PHP2Shell get cheaper every few months, and there’s a lot of code under the internet that gets far less attention than PHP does.

Then, details leaked on Tuesday. A day before, the fix was ready, and the PHP team rushed the patch out. Cloudflare says it saw thousands of attack attempts in the hours before the announcement, hundreds of thousands within two hours of it, and millions by that night. Amazon says it spotted someone trying the flaw on October 17, four days before anyone was supposed to know.

If you run a proper IT team, the fix is easy. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP’s own note is blunt: there’s no workaround; updating is the only safe choice. The trouble is everyone else. Roughly 5 million servers run PHP, and about 7.5 lakh of them are on versions so old, there’s no patch at all.

PHP has put out source code for people on 7.4, 8.0 and 8.1 to build themselves. But this is useless to, say, a shop owner who doesn’t know what version he’s on, never mind how to compile one. That’s why NSA and FBI suggested that if you can’t patch, pull the plug.

Finland took its government web services down. The Dutch cyber agency took its site offline. France’s interior ministry went into maintenance. Japan’s tax agency, ANA, Nomura and MUFG pulled services. Wikipedia went dark for a while. Not one of them was breached. They just decided a website that’s off and safe beats one that’s on and open.

ET Bureau

CERT-In put out a critical advisory on Wednesday. Find out what version you’re on. Patch today if you’re on a supported branch. If the site was built before 2022, you’re probably not. So, either get it rebuilt, or put a web application firewall in front of it and understand that’s borrowed time.

Look at your logs for PHP processes spawning shells or downloading files. And change every password and key ever stored on that server, because reading those out of memory is exactly what this flaw is for.

The bigger fix isn’t technical. The people who shipped Wednesday’s patch are a few paid developers and some volunteers. Companies that make billions on PHP send them almost nothing. A couple more full-time maintainers would cost less than one of this week’s shutdowns, let alone a real breach.

We pay for the lock after the burglary, every time. PHP won’t be the last. It was just the first one big enough we all noticed.

The writer is programme director (Eastern India), WHEELS Global Foundation.