PHP2Shell Critical Vulnerability

[Kul]

If you haven't read it in the news, public disclosure of two critical PHP vulnerabilities were made yesterday.
Security advisories and Government agencies all recommended that sites and applications that use PHP immediately shutdown.
I took down our server immediately.
A fix, which had been developed for a month, was pushed out.
This fix has now been applied to our server.

70% of the internet relies on PHP.
The vulnerability was identified in August but kept under embargo so that a fix could be prepared and delivered before bad actors could take advantage.
The fault, which was in the code since the mid 2000's, allowed for potential full access to be gained to a server. There's no evidence yet of it having been exploited in any meaningful way. The risk now is that slow-to-act web admins will be exposed

The impact of this will be huge.

 

[Leck]

If you haven't read it in the news, public disclosure of two critical PHP vulnerabilities were made yesterday.
Security advisories and Government agencies all recommended that sites and applications that use PHP immediately shutdown.
I took down our server immediately.
A fix, which had been developed for a month, was pushed out.
This fix has now been applied to our server.

70% of the internet relies on PHP.
The vulnerability was identified in August but kept under embargo so that a fix could be prepared and delivered before bad actors could take advantage.
The fault, which was in the code since the mid 2000's, allowed for potential full access to be gained to a server. There's no evidence yet of it having been exploited in any meaningful way. The risk now is that slow-to-act web admins will be exposed

The impact of this will be huge.

Use Cloudflare and Wordfence. I wasn't affected.

 

[Odessa]

If you haven't read it in the news, public disclosure of two critical PHP vulnerabilities were made yesterday.
Security advisories and Government agencies all recommended that sites and applications that use PHP immediately shutdown.
I took down our server immediately.
A fix, which had been developed for a month, was pushed out.
This fix has now been applied to our server.

70% of the internet relies on PHP.
The vulnerability was identified in August but kept under embargo so that a fix could be prepared and delivered before bad actors could take advantage.
The fault, which was in the code since the mid 2000's, allowed for potential full access to be gained to a server. There's no evidence yet of it having been exploited in any meaningful way. The risk now is that slow-to-act web admins will be exposed

The impact of this will be huge.

I have noticed you are very smart with computers I know how to use the off and on button and when it jamms to press and hold the off button to make the computer work again

 

[Tim Sheens]

If you haven't read it in the news, public disclosure of two critical PHP vulnerabilities were made yesterday.
Security advisories and Government agencies all recommended that sites and applications that use PHP immediately shutdown.
I took down our server immediately.
A fix, which had been developed for a month, was pushed out.
This fix has now been applied to our server.

70% of the internet relies on PHP.
The vulnerability was identified in August but kept under embargo so that a fix could be prepared and delivered before bad actors could take advantage.
The fault, which was in the code since the mid 2000's, allowed for potential full access to be gained to a server. There's no evidence yet of it having been exploited in any meaningful way. The risk now is that slow-to-act web admins will be exposed

The impact of this will be huge.

Heroim Slava!

 

[orange&black]

Hi Kul
Thanks so much for what you do, not that I have any idea, but the fact you’re looking after it!! Cheers

 

[jadtiger]

If you haven't read it in the news, public disclosure of two critical PHP vulnerabilities were made yesterday.
Security advisories and Government agencies all recommended that sites and applications that use PHP immediately shutdown.
I took down our server immediately.
A fix, which had been developed for a month, was pushed out.
This fix has now been applied to our server.

70% of the internet relies on PHP.
The vulnerability was identified in August but kept under embargo so that a fix could be prepared and delivered before bad actors could take advantage.
The fault, which was in the code since the mid 2000's, allowed for potential full access to be gained to a server. There's no evidence yet of it having been exploited in any meaningful way. The risk now is that slow-to-act web admins will be exposed

The impact of this will be huge.

Great proactive response Kul,when i read about the exploit on the BBC website early this morning i noticed that this website was down and assumed you were responding to the threat.I am an old Luddite but appreciate everything that you do on here for us supporters.
Great work as usual.