PHP2Shell: Exploitation attempts and remediation trends

xx_ns

"No successful PHP2Shell exploits seen so far"... in the wild, specifically in Wiz's honeypot. The vulnerability itself has been successfully exploited, most notably for the "Steal my Bitcoin" challenge [1] as one example. Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim. [1]: https://stealmybitcoin.com/ [2]: https://news.ycombinator.com/item?id=50226010 EDIT: The HN title has been changed since posting this comment.

6_7

I'm so sorry, exposure is down how many percent?

rprouse

And at the same time Bleeping Computer is saying it has been successfully exploited, https://www.bleepingcomputer.com/news/security/php2shell-sec...

larahawkinsauth

Great Breakdown

makmanalp

This has been my hyperfixation for the last few days, and I've been trying to keep together a detailed and timestamped timeline of the evolving situation: https://claude.ai/artifact/5cZex56WutyVnpMBrWXxzV TLDR is multiple entries that show successful exploitation against particular setups (quite often honeypots that were kinda set up to be exploitable e.g. single worker mod_php or lab setups that are unclear on how well they match real deployments), one claim from dan guido / trail of bits about a broad exploit (but few details), millions of attempts in the wild but very little evidence of actual compromise (unit 42 withdrew theirs).

phplovesong

PHP just sucks so bad.

denysvitali

> but these scanners did successfully exploit Adel Karimi's honeypot, which was a likely contributing factor to CISA’s decision to include PHP2Shell in their KEV list. Adel is doing an amazing job. Both in open source ( https://github.com/perplexityai/bumblebee , https://github.com/perplexityai/numbat , https://github.com/0x4D31/galah ) and with his reports. So proud of him!

CircuitsFit44

For teams still working through the patching, the practical first step is an inventory of which internet-facing hosts and containers actually run an affected PHP version, since that list is often incomplete. Patching also does not remove anything already planted, so on exposed hosts it is worth checking web roots and upload directories for new or modified PHP files and reviewing access logs from before the patch date. Honeypot data showing few successful attempts is a useful trend signal, but it says little about whether your own servers were hit.

paaloeye

Everyday is a zero-day nowadays

pizlonator

This is all it takes to port PHP to Fil-C and according to our tests this turns all of the exploits into DoS https://github.com/pizlonator/fil-c/blob/deluge/projects/php...