PHP2Shell exploitation confirmed, but mass attacks remain elusive
While there were credible reports over the weekend of exploitation in the wild of the two PHP2Shell bugs that caused all the fracas last week, as of the afternoon of Oct. 26, there are no known public reports of successful exploitation — and no widespread exploitation.
23 statement that said that an attack against a European government agency was related to a vulnerable PHP2Shell application.
In the update, Unit 42 said the cybersecurity firm was unable to confirm that initial access was associated with either of the two PHP2Shell bugs.
While there were credible reports over the weekend of exploitation in the wild of the two PHP2Shell bugs that caused all the fracas last week, as of the afternoon of Oct.
26, there are no known public reports of successful exploitation — and no widespread exploitation.
26 blog that as of this reporting, PHP2Shell had yet to become the mass exploitation event many in the industry braced for.
Calderone said Trail of Bits CEO Dan Guido has since gone further and described it as "production-grade," working against stock production configurations with ASLR enabled, multiple workers, and normal memory limits, under load, on both Apache mod_php and nginx PHP-FPM, on ARM64 and x86-64, and with a chain that ends in root.
Translated: There could very well be a public exploitation on a large enterprise, it just hasn’t been reported yet.
Major research groups also walked back original fears of widespread exploitation of PHP2Shell on Oct.
But the real question is actually whether reliable, indiscriminate exploitation is happening, and for now, the answer is a firm 'No.'” Denis Calderone, chief technology officer at Suzu Labs, has some good research on what actually is going on.
26, Calderone said the Delft Threat Intelligence Lab's honeypots and network telescope had recorded more than 50,000 PHP2Shell exploitation requests from more than 600 addresses in 70 countries.
What happened
23 statement that said that an attack against a European government agency was related to a vulnerable PHP2Shell application.
In the update, Unit 42 said the cybersecurity firm was unable to confirm that initial access was associated with either of the two PHP2Shell bugs.
What changed
While there were credible reports over the weekend of exploitation in the wild of the two PHP2Shell bugs that caused all the fracas last week, as of the afternoon of Oct.
26, there are no known public reports of successful exploitation — and no widespread exploitation.
Who is affected
26 blog that as of this reporting, PHP2Shell had yet to become the mass exploitation event many in the industry braced for.
Calderone said Trail of Bits CEO Dan Guido has since gone further and described it as "production-grade," working against stock production configurations with ASLR enabled, multiple workers, and normal memory limits, under load, on both Apache mod_php and nginx PHP-FPM, on ARM64 and x86-64, and with a chain that ends in root.
Why it matters
Translated: There could very well be a public exploitation on a large enterprise, it just hasn’t been reported yet.
Technical details
Major research groups also walked back original fears of widespread exploitation of PHP2Shell on Oct.
But the real question is actually whether reliable, indiscriminate exploitation is happening, and for now, the answer is a firm 'No.'” Denis Calderone, chief technology officer at Suzu Labs, has some good research on what actually is going on.
26, Calderone said the Delft Threat Intelligence Lab's honeypots and network telescope had recorded more than 50,000 PHP2Shell exploitation requests from more than 600 addresses in 70 countries.
Response
25 update that said Trail of Bits has a working exploit that has not been released publicly.
Teams should still prioritize patching and upgrading without question.” Calderone said Suzu Labs is tracking the Perplexity findings that an Oct.
What security teams should do
Calderone said Delft has their finger on the pulse, measuring the noise, the sheer volume of scanning, while Adel Karimi at Perplexity recorded 35 working shells on unpatched PHP 8.4.26 under Apache mod_php by way of his honeypot farm.
Attribution
SC Media: While there were credible reports over the weekend of exploitation in the wild of the two PHP2Shell bugs that caused all the fracas last week, as of the afternoon of Oct.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.