Two unauthenticated PHP RCE flaws affect every version since 5.4
The claim
The authors claim that the two unauthenticated remote code execution flaws in PHP affect every build since 5.4 and have no patch for PHP 8.1 or older.
Published as: “I had plans for that second”
So what
All PHP deployments are exposed to unauthenticated remote code execution, requiring immediate upgrades and IDS detection.
The five-minute version
Talos discovered two unauthenticated remote code execution flaws in PHP, called php2shell, that are triggered by a simple HTTP request and affect every PHP build since version 5.4. The vulnerabilities have no patch for PHP 8.1 or older, and Talos recommends upgrading to PHP 8.2 or later. Cisco Talos provides Snort signatures 67359 and 67360 to detect exploitation attempts. Evidence of exploitation attempts is mentioned, but no quantitative data is provided.
What they found 3
- Two unauthenticated remote code execution flaws in PHP affect every build since 5.4
“Two unauthenticated remote code execution (RCE) flaws were discovered in PHP, rocking the internet. Dubbed "php2shell" and triggered by a simple HTTP request, this vulnerability affects every build since 5.4.”
- Cisco Talos provides Snort signatures 67359 and 67360 to cover the vulnerabilities
“Cisco customers are covered with the Cisco Talos Network Intrusion Prevention (SNORT®) signatures 67359 and 67360.”
- There is no patch for PHP 8.1 or older
“There is no patch for PHP 8.1 or older.”
What’s new here 4
- Two unauthenticated RCE flaws (php2shell) discovered affecting all PHP versions since 5.4
- No patch available for PHP 8.1 or older, urging upgrade to PHP 8.2+
- Cisco Talos released Snort signatures 67359 and 67360 for detection
- Talos reports exploitation attempts in the wild
Artifacts & methods 2
- php2shellprimitive
- Snort signatures 67359 and 67360system