r/technology • u/Radio_TVGuy • 12h ago
Security New PHP vulnerability means the Internet will have a very rough couple of days
https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days738
u/thefuckevengoingonan 11h ago
arbitrary code execution on any website that runs PHP versions 5 through 8
very rough day
484
u/xFlumel_ 9h ago
For context, that means any version released between 2004 and yesterday
245
u/DogsRNice 8h ago
The people who run websites that haven't been updated since 2003 are probably feeling really good now
56
u/RegularNormalAdult 7h ago
That would be 4chan.
22
u/UltraNoahXV 7h ago
A lot of Wikis and older sites too for any topic. Heck...the government depending on where you are.
39
15
u/red286 3h ago
That'd be me!
I actually started panicking when I first saw these reports because I am stuck on an ancient version of PHP due to legacy hardware and OS. I've been working on reworking everything to run under the latest version of PHP, but it's slow going, and there was no way I'd be able to get the new version out by tomorrow.
Then I saw that it affects versions 5.4 through 8.5.11.
Which makes me kinda glad I'm stuck on 5.3.2.
18
u/pittaxx 2h ago
Well, your systems are only missing 23 years of security patches. I'm sure you're fine...
→ More replies (1)→ More replies (2)6
469
u/snklznet 11h ago
Wordpress users in shambles
106
u/HeurekaDabra 10h ago
This is really interesting to follow.
Feels like half the internet slowly goes down while the news still spreads and developers franatically scan their projects just to find some php in old corners of their solutions nobody touched for years.
I'm so glad right now. My company had to take down one single server that is also just a backup.
Other companies in our group had to take down their products completely.23
u/Single-Virus4935 9h ago
Dont forget appliances e.g. IoT, Routers, Firewalls.
Fortinet, junioet and many others usw PHP for webinterfacea, captive portals and apis.
8
u/aurumae 4h ago
The really scary one imo is for small businesses who have a web presence but aren’t big enough to have any full time devs maintaining it. Like say you are a small press RPG publisher and you have a website and a forum that you paid some guy to set up for you fifteen years ago. They may not even hear about this issue or realize that it affects them, let alone have the know-how to update PHP.
194
46
→ More replies (1)1
310
u/MaxRD 10h ago
Couple of months, more likely. The vast majority of exposed and vulnerable sites are managed by people who will not be aware of it until after they get compromised
39
u/ILOVECOCKSTARGAMES 8h ago
If someone hosts a site how do they get their info compromised from this? And will there be data leaks on other sites members?
94
u/tommyk1210 8h ago
This is basically an exploit that allows an attacker to perform remote code execution (RCE). That is one of the worst exploits you can have.
An attacker, under certain circumstances they can induce, can basically get a full “shell” (terminal/command prompt equivalent) on the target server.
This means they can, for example, tell the server to send all credentials on disk to a remote server, or find the database password somewhere on config/disk and login to the database, then dump the whole thing to some remote server.
It’s bad.
20
u/MrTastix 6h ago
Yeah, I am a member of forums which haven't been active in years but are still around for prosperity reasons.
There's no good way to contact the hosts of these people to let them know, that's how inactive it is. The admins likely already know about this given their professions but they have to still remember all the projects they worked on 15 years ago with PHP to go back and fix it.
23
u/tommyk1210 6h ago
Nah, plenty of these admins were teens setting up web forums in the 2000’s, that was me too. Some, like me, will have made a career of it but just as many are happy to pay the modest hosting fees and have zero real idea what they’re doing.
→ More replies (2)3
4
u/lilB0bbyTables 2h ago
Even the ones that are aware are going to have struggles. The patches will only be applied to latest PHP version … plenty of old sites are running older PHP 5 - 7 and have done so because the cost/effort to migrate is expensive. If they want to mitigate these vulnerabilities they are going to need to migrate, which means going in and updating a bunch of dependencies, running all their tests and/or manual smoke testing, fixing all the inevitably broken stuff, then rolling out those deployments. For many folks and teams, that could take days/weeks which leaves them sitting ducks unless they have the liberty of taking their software offline.
3
u/ToiletSeatFoamRoller 1h ago
Yeah we’re relying hard on the virtual host memory options and Cloudflare to protect us in the meantime. It’s been a scary day making sure that’s all airgapped (as much as it can be). Yes I’ve been shouting from the rooftops for two years that something like this was going to happen, now they have to prioritize it.
2
u/lilB0bbyTables 1h ago
Stakeholders/management failing to grasp the financial risks associated with not paying down technical debt - the tale as old as time. Rather than paying it off up front, or even a little at a time, now they get to pay it with interest.
At every org I have worked for, I have kept an internal wiki page dedicated to aggregating a list of technical debt that I was aware of (and encouraged others to co tribute to that page). I always keep a nice table along with it to identify each item in a row alongside a column giving a rough estimate on effort to address it and another assessing the overall risk associated with it. I have found that other folks appreciated it and more importantly, it has proven to be effective in getting green lights to schedule it into sprints to go ahead and pay some of it off iteratively.
67
u/dyzioslaw 6h ago
Worth stressing for anyone running WordPress, Drupal, PrestaShop etc.: this is in PHP itself, not a plugin, so keeping plugins updated or running a security plugin won't save you. No login needed either.
What I'd do today:
Back up first (files + DB, or just snapshot the VM)
Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. On shared hosting, ask your host if they've rolled it out yet. If you're on Debian/Ubuntu/RHEL, don't panic if `php -v` shows an older number. Distros backport the fix, so check the package changelog for the CVE IDs instead.
If you really can't update today, the advisory lists a few temporary settings (`session.upload_progress.enabled=0`, lower `post_max_size`). They help a bit but they're not a fix.
And if you're still on 8.1 or older, there's no upstream patch at all, so it's time to move. As someone said: it's better to have broken site than a hacked site...
I put together a longer guide with commands for apt/dnf/Docker and the hosting panels if anyone needs it: https://szympanstudio.pl/en/blog/critical-php-vulnerability-update-your-server
18
u/icoder 6h ago edited 6h ago
> And if you're still on 8.1 or older, there's no upstream patch at all,
That's not entirely true. Ubuntu has released updates for LTS's back to 14.04, which runs php 5.5.9. You need Ubuntu Pro for that, but that is apparently free up to 5 machines, rather easy to set up and after that it's just `sudo apt-get upgrade` (edit: apparently THIS patch requires a legacy add-on to pro which is NOT free, *sigh*)
2
u/dyzioslaw 6h ago
I think that this issue is severe enough that older php versions will also get some patches, maybe not official ones, maybe just ported using ai - but they will.
103
u/BufferUnderpants 9h ago
First time I've seen Wikipedia down.
The article doesn't give many details, but this is a pair of memory-related remote code execution vulnerabilities, there are fixes for PHP 8 but it's not clear to me if it's only PHP 8 that's affected.
54
u/Single-Virus4935 9h ago
Php5-8.
I know many orgs still on php5 and they have no clear upgrade path. Tech debt might break many necks this time
6
u/LexGarza 8h ago
Damn, we had to jump from 5 to 8 in the summer. It was disastrous. On the bright side (for us), we were on the latest
2
u/Single-Virus4935 8h ago
That is why I like go. Code from 2015 still compiles with minor changes (1-2 breaking changes).
21
u/pissingtoxicspores 9h ago
I'm like, a normal person on the internet, is this like a "go offline for 2-3 days" type of thing? Do I need to update all my passwords everywhere? How do I know what websites are safe or not?
29
u/morgrimmoon 9h ago
For most large affected websites, it'll be a "website might go down for a day or two while it gets patched". Wikipedia is huge and constantly targeted by criminals (and some governments), so they're going to cop it much worse than others will.
→ More replies (1)9
u/super_aardvark 8h ago
The vulnerability isn't a risk to you directly. Any site that's down right now is doing the right thing, and you can probably trust them once they come back up. Plenty of sites are completely unaffected by the vulnerability (because they don't use PHP), so no problem there.
If any sites do use PHP and don't go down at all during this, there's a chance they could be hacked. Unfortunately, it's tough for a layman to tell these sites apart from the ones that don't use PHP.
If a site is compromised, then the risk to you depends on what the hacker wants to do (no fundamental difference from past website hacks). Publishing your username and password for the compromised site, or other data the site has about you, is the most common thing that could affect you. The strength of your password would determine how quickly it gets published (if at all), and if you're using the same password on other sites then that would be bad.
I don't think there's any reason to go offline for 2-3 days. Maybe avoid entering your credit card on small mom-and-pop e-commerce sites. (Do those exist?) Anyone with a half-competent IT department knows about this and is taking it seriously.
10
u/Laevatienn 8h ago
It can take a few hours, depending on how big the site is, how much testing they do before brining them back up, etc.
For reference, a lot of media sites in Japan went down around 22:00 PM JST and are back up 2-3 hours later. Some are still working on patches. So. Really depends.
One of the factors is the current used PHP version at each site. Jumping from 8.5.11 to 8.5.12 (fixed version) should be pretty straightforward. Jumping from a super old version, like 7.1.5 (nobody should be here), to a 8.5.12 might break things and require more work.
Another factor would be how well the site/company has built their dev to testing to making the site live process. The better the setup, the faster it goes. The more manual steps, the longer it will take.
3
u/LGBTQLove4Ever 6h ago
Keep in mind: you don't need to be on the latest version, 8.2 and above gets the patch
→ More replies (2)22
u/comicsnerd 9h ago
Bug is from code back in 2008. So a lot of old obsolete PHP versions are impacted too.
1
u/iamthe0ther0ne 6h ago
I was wondering why my whole university domain was down today. Guess this probably explains it. I wonder if yesterday's Google Cloud/Revolut outage was related?
2
u/BufferUnderpants 5h ago
I don't know about Revolut, but Google doesn't use PHP, they've always been very strict from the top down about their technology choices and they only use a handful of languages.
49
u/deweydm 9h ago
Forum I visit regularly hosted on Cloudflare shared this: https://blog.cloudflare.com/php-vulnerabilities-waf-protection . "Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers."
209
u/Stargost_ 9h ago edited 8h ago
You know shit is bad when Rule34, Wikipedia, and the Steam Store are all down simultaneously.
31
34
u/EngRookie 6h ago
but how will i jerk off to random characters in games from my steam library while reading about quantum chromodynamics now🥺?
8
u/Visible-Task-2798 4h ago
Damn if only I had the same IQ as yours in order to jerk off to characters in my steam library.
147
u/Lousy_Username 10h ago
This is going to cause a lot of disruption. I've already seen a ton of sites that have taken themselves down until they can patch.
29
u/lovehopelove 10h ago
do you have a list of sites affected or perhaps an article listing some? I am finding very little information on what major sites are affected.
25
u/comicsnerd 9h ago
Half the government sites and los of NGO sites in the Netherlands are down. Many wordpress sites are down.
A patch has been provided for PHP 8.2 and up, but many servers are not up-to-date and will have a rough month to upgrade and then see what sites fail.
62
u/Thongasm420 10h ago
4 chan is in read only. X videos premium not working :( truly a sad day
157
u/RyghtHandMan 9h ago
I can't help but infer things about your life from these examples
96
39
u/webternet 8h ago
Dudes name is thongasm
52
u/Thongasm420 8h ago
plz dont leave out the 420 part its really important to my identity
13
8
u/EngRookie 6h ago
"IT'S A PIMP NAMED SLICKBACK YOU HAVE TO SAY THE THE A PIMP NAMED PART TOO"
2
u/nashbrownies 3h ago
Is that a Mission Hill reference!?
"Ahhhh, so this is legitimate massage!"
Edit: Boondocks actually I think
→ More replies (2)9
u/taurusApart 8h ago
Right but maybe that's his surname?
Maybe he comes from a long line of Thongasms?
7
3
→ More replies (1)7
14
u/linux_transgirl 10h ago
Anything running mediawiki should be down if the webmaster knows whats up, with the exception of Wikipedia as they have mitigations in place for this sort of thing iirc
5
u/Lousy_Username 9h ago
Looks like Wikipedia is down now as well.
4
u/linux_transgirl 9h ago
It seems that anything that isn't cached in some way is down. Clicking around the homepage and seeing were the featured article take me will sometimes give me a page but otherwise it doesn't
→ More replies (2)6
2
9
u/Single-Virus4935 9h ago
My health insurance APP/Website is in maintainance mode since yesterday. Some sites are just displaying 403 or simple refuse connections. My former employers services and websites all show 403 and I know the php and update situation is pretty bad.
I bet Claude will have to work through a mountain of legacy php code the next days just to be able to upgrade to the patched php versions.
67
u/bryansj 11h ago
I'm stuck with two Joomla v3 sites with obsolete theme packs breaking migration. These need to be put out of their misery.
57
-6
10h ago
[deleted]
→ More replies (1)9
u/casualti21 9h ago
No idea why you’re getting downvoted. I have a Wordpress blog, I’m not a web developer. I used Codex to migrate everything to EmDash CMS. It literally did everything, from planning the migration, to theme development, to actually deploying the new site.
Many new CMS platforms are built for this workflow. EmDash is one of them. AI agents will do the vast majority of web development in the future. No point in painstakingly hand coding CSS and HTML or basic plugins.
→ More replies (5)5
u/HeurekaDabra 9h ago
Never forget, when everything is designed, prompt the LLM to 'now make it look less like AI did it'.
oprahyougeta.jpg: And you get traffic light indicators! And you get traffic light indicators! And you...catch my drift.
→ More replies (3)
27
u/Wetbug75 8h ago
I wonder if we're going to read stories in the next few weeks of people discovering rogue AI agents that have used this exploit to install themselves on various servers. They could even patch the exploit behind them, possibly remaining undiscovered indefinitely on some old systems nobody checks.
Scary stuff.
12
u/fleetingwords 6h ago
Web servers wont have the hardware to run frontier models. Not even close. They could install other apps, use them as bulletin boards, or backup their code though.
4
u/iamthe0ther0ne 6h ago
Guess what?
"Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. "
→ More replies (5)9
u/Odious_Otter 5h ago
Source someone other than a source that relies on stoking the fires of AI for business.
→ More replies (3)
27
u/MrMagicMarker43 8h ago
I have a small web game, that is hosted on one of those free website hosting sites. It uses php for the users input and connecting to the database. Is this something I need to patch, or is it something the web host will patch? I am not savvy in this area so I don’t know if this is a problem for me or not
13
13
u/VictorVogel 8h ago
Yes this is likely a risk. It sounds like there is no important info on that server that someone might want to steal, and it is almost certainly running inside some container, but someone could basically take control of it and use it for their own purposes.
8
3
u/gin_and_toxic 2h ago
If this is a fully managed hosting, they are responsible to do this. You can send a support ticket to ask about the status.
Otherwise it's your full responsibility.
4
u/yuusharo 7h ago
Yes. Absolutely. Contact your host provider asap for information on what actions you need to do.
This is a serious issue. Don’t put this off.
40
u/linux_transgirl 10h ago
This with the compromised certs earlier mean the past 24 hours are likely to replace heartbleed as the worst day in cybersecurity history
12
u/MidgetRodeoClown 9h ago
The fact that a Sectigo AAA cross sign cert is part of the exploit for the cert stuff is mindnumbingly bad.
10
u/bron_101 8h ago edited 7h ago
Finally managed to get the patch deployed everywhere and services reenabled... what a shitshow. Various repos and mirrors getting flooded with requests and timing out made things worse.
I do think that the whole responsible disclosure process needs rethinking in the AI era. How long do we have now until AI agents start using new attacks? 15 minutes? It takes longer than that for patches to get seeded through mirrors, let alone actually deployed. We were ready and waiting for the patch and it still took us an hour or two to get it fully deployed.
When you get these kind of remote RCE in major very widely used services, I'm starting to think the only safe thing to do is shutdown services until patching is done. Before you could rely on attackers needing to get human eyes on the patch, figuring out the problem and spend a while writing exploit code. Now you can point your local unrestricted llm AI agent at PoC code and disclosures, and within minutes you have automated attacks going - worse, automated attacks with intelligence that allows figuring out maximum damage/value and chaining to other targets.
Lets not even talk about what happens if you get leaks that even vaguely hint at the issue, people send their AI tools to find the issue, and either partially (like today) or completely find the issue before a patch is even available.
Damn this has been a long day.
6
u/ecptop 8h ago
I have a audiobookshelf server tunneled with cloudflare so I can access if from any browser. Also shelfmark the same way. Do I need to do anything or am I at any risk
5
u/Ok-Eggplant-7569 8h ago
No, Audiobookshelf is JS and Shelf mark is Python. Neither use PHP.
Edit: Of course, it's still best practice to have your stuff up to date regardless.
2
21
u/Psychostickusername 9h ago
I've got some self hosted stuff that i access through my own domain. Media servers and apps for private and family use. Does this affect them or do I need to do any thing?
22
u/LostMyConcentration 9h ago
If they run php, or things like wordpress that use php, and are open to the internet aka usable outside of your network, it can affect you. If not, you're probably safe
19
u/FIFAfutChamp 9h ago
If you are using Seerr, Aarr stack and Plex you are fine. None of these use PHP.
17
u/christoy123 8h ago
Although Plex had a similar cve very recently so make sure everything is up to date
6
25
u/MaxRD 6h ago
The fact you run stuff exposed to the outside and have no idea if it’s using PHP is a problem of its own. I would recommend you turn it off until you figure out what you are doing
→ More replies (12)6
u/ajnozari 9h ago
any php deployed on a version prior to today’s is vulnerable and needs to be updated.
7
u/yawara25 9h ago
It depends. Does any of it run PHP?
5
u/Psychostickusername 9h ago
I'm honestly not sure, a lot of them were setup in docker, I do keep them up to date though so guess I best go through the containers and check. Thank you
5
u/morgrimmoon 8h ago
Go through your containers and update them this weekend. The big ones are if you have MediaWiki or NextCloud, their Docker containers are definitely affected. Plex is currently being hit by a separate exploit, so update that too. Wordpress, if you use it. Those are the big ones needing patching ASAP.
→ More replies (1)3
u/marvinfuture 9h ago
By self hosted do you mean you are accessing via a public IP or your private internal IP while on the network. If it's public, you need to remediate, if private, you'll at least have some protection, but it would still be recommended to remediate
2
u/WolpertingerRumo 7h ago
Just run updates if you run it on metal. If it’s docker, run them tomorrow, when everyone has finished integrating the security updates.
2
u/Evening_Expert_6222 9h ago
You should probably be able to answer this question yourself if you're going to expose self-hosted services to the internet.
2
u/Hayden2332 9h ago
Is any of it exposed to the internet?
1
u/Psychostickusername 6h ago
Yes, albeit behind Https and login pages rather than just exposed web pages
3
u/WindowlessBasement 5h ago
The vulnerability walks right through "login pages". The issue is how the server processes the request before executing the PHP code.
1
u/irritatedellipses 9h ago
Do you run Pelican or Pterodactyl for game serving? Both of those are php based.
Nextcloud iirc. Drupal. Bookstack.
I haven't started digging in to what the issue is mind you, I'm just thinking of self hosted php based things I ran in the past.
→ More replies (2)1
u/chefborjan 9h ago
Same for me, but connecting via Tailscale so I think I’m okay?
1
1
u/staythewaters 39m ago
So long as you know for sure no one with Tailscale is on your tailnet, then this seems like a low risk. Nothing is ever a straight "yes you'll be okay," but in terms of what is actually exposed here, I'm not going to freak out on my containers that I have on my tailnet. Everything is pretty well locked down and I'll run the updates I need on my server tomorrow.
→ More replies (7)1
u/TwiceInEveryMoment 4h ago
If any of them run PHP then I would assume yes. I had to take a couple of my self-hosted sites off the internet until the patch is available.
29
u/djamp42 10h ago
Been patching all last night and this morning
31
u/Neryuslu 10h ago
What? The patched versions have only been released 1 hour ago.
→ More replies (1)32
u/NoPossibility4178 10h ago
Those are the public patches, fixes for this have been pushed out for a while now, issue is that the CVE got leaked.
2
40
u/SqeeSqee 11h ago
I keep seeing news about this. But I am very computer term illiterate. Even eli5's are too complicated. Why is this only affecting EU and not US?
132
u/TheOwlMarble 10h ago edited 8h ago
It's not just the EU, but an EU group made a comment on it.
ELI5: all PHP servers versions 5-8 can be fully taken over with trivial effort from anywhere in the world due to a 9.2/10 severity vulnerability. A patch exists, but PHP servers are often very old and may not be maintained, so a lot of these servers are about to join botnets or be ransomed.
22
u/SqeeSqee 10h ago
Whats the difference between a PHP server vs a regular server? Why would they join a botnet? Is it because a bot can just hijack the servers now? If they get hijacked is it too late to update them with the fix?
69
u/SubmergedSublime 10h ago
Server is a general term for a computer listening to the Internet, and waiting to respond when someone asks for something (“serving it” if you will.)
You can code that server in literally any computer language. It just has to be able to listen for web requests: no one else cares what language it is written in provided it can listen and serve.
PHP is a very common one, and was especially common in past decades. Which is a reason this bug is especially hard: it impacts a lot of servers and hardware that were written ten years ago, still exist, but haven’t been maintained or updated in years. Or are maintained, but rely on other old stuff so they can’t easily be updated as that stuff breaks.
So “PHP servers” is a huge chunk of the internet connected world. (Python, Go, and JavaScript are other super common languages for servers. They all the same basic tasks. Each language has its pros and cons for the ease of developers, but the end result is effectively the same from the outside)
16
u/TheOwlMarble 10h ago edited 9h ago
A server is just a computer that takes requests from other computers and responds to them without human intervention.
There are several programs that can do the actual request processing. PHP is one of them, powering up to 80% of servers. NodeJS (common for a lot of modern websites) is another. As this is an issue with PHP, NodeJS servers are untouched.
As for botnets, it's common for state-sponsored hackers to quietly take over vulnerable servers and then use those servers at a later date to attack other computers. Private hackers may also use botnets to mine crypto or could just use this vulnerability to hold servers for ransom.
Extricating an infected server from a botnet is often doable if you have physical access, but some are very very hard to expel and may require wiping the hard drive.
3
u/BufferUnderpants 9h ago
To add, PHP is the underlying software of some very widely used applications, notably Wordpress, which is used to display the blogs and webpages for private individuals, small businesses and local government agencies all over the world.
A copy of Wordpress running on some version of PHP has been set up to run hundreds of thousands of times independently, by unrelated people, as it was the cheapest option available to have a webpage like this.
The underlying computers will be left exposed by this vulnerability, as it allows attackers to run their own code in them.
4
u/datskinny 10h ago
PHP servers are web servers that host sites made with PHP. But PHP is not the exclusive language to write webpages in, so there are other servers hosting those. Once compromised, joining botnets is just one of the use cases.
13
u/Thepumpkindidit 10h ago
Is it possible for someone to use this exploit for good. As in use the vulnerability to take over a website and upgrade the PHP for them?
25
u/xchaibard 10h ago
Update? Not really.
Just Take the server down so that someone notices it's vulnerable is probably the best option.
Whenever someone asks me at work what an unlabeled, apparently ignored server does or who owns it, or if it's even still being used, I tell them to just turn it off and see who shows up. If no one shows up in a week they can decommission it because it's obviously not being used for anything important lol
11
7
u/oddsnsodds 10h ago
Remote updates that disable your connection after the update can be disastrous
→ More replies (1)2
→ More replies (1)5
u/DiamondIceNS 9h ago
Theoretically, sure.
In practice, updating a major version of PHP like v7 to v8, or way worse, v5 to v8 (v6 was skipped, it's a long story) is not trivial. If you upgrade the PHP version, but your website uses old-style code that the newer version of PHP ripped out for being outdated, your site just breaks. Ask me how I know...
I suppose you could, if you were so inclined, have an LLM auto-migrate the problematic code. But now we're out of cheeky benevolent white hat hacker territory and into "idiot hacker dumps buckets of money on strangers for fun" territory.
3
u/DragonSlayerC 7h ago
Why is it not a 10?
6
u/TheOwlMarble 6h ago edited 6h ago
PHP self reported it as 9.2, but watchTowr has disputed that, calling it a 10. As I understand it, the discrepancy is based on disagreements of how easy it actually is to cause the memory corruption issue.
I'm inclined to believe the 10 because PHP has known about this since 2024 and didn't deal with it, in part, because they themselves couldn't figure out how to attack it, demonstrating that they are not the best judges of this.
1
u/00DEADBEEF 9h ago
so a lot of these servers are about to join botnets.
It's worse than that. The exploit gives an attacker a shell, so they can run any command, which means exporting data such as the entire database, or file uploads in private systems, is very easy.
14
12
33
u/kwartel 10h ago
It’s affecting everybody. The most simple explanation: most websites use a programming language called PHP. Every version of that language released in the last 20 years has an issue where with a rather simple trick, hackers can access the server the website is running on. Once they are inside, depending on further measures the people setting up the server took, the attacker can access customer data, or change the website.
See this like finding out that the most popular door lock has a neat little trick which takes you 3 seconds to lockpick any door in the world. But because this is the internet, you also can be at the front door of every house in the world in milliseconds
12
u/PM_ME_SAD_STUFF_PLZ 10h ago
You basically described the fob locks that most new apartments have that allow for the lock to be open via a paper clip into the weep hole
2
u/WloveW 10h ago
Good to know. When all the apartment lock apps get bricked everyone can still get in! Well maybe not good everyone can get in...
→ More replies (1)2
2
4
14
u/NotTheHeroWeNeed 2h ago edited 2h ago
I maintain a few dozen websites across multiple servers. All I had to do was update to the latest php patch, and restart the service on each server. It took about 5min to do with basically no disruption. This is potentially serious, yes, but I feel this story is being blown out of proportion.
Edit:- seems I’m just lucky because I’ve kept all my sites up-to-date and and running php 8.2/8.3
16
u/tyda1957 2h ago
It's an RCE affecting most of the internet. Not sure how it could possibly be "blown out of proportion".
4
u/WannaBeHappyBis 1h ago
Lots of sites do not have (proper) maintenance.
Others are stuck on olders PHP versions because of a huge variety of reasons.
3
2
1
7
3
3
2
2
u/OkCommuter1997 6h ago
Your hosts should sort out the patch. Make sure your site/wordpress or anything using php is 8.4 and above to receive the patch.
7
2
1
1
1
1
1
1
1
u/Black_Handkerchief 39m ago
I wonder if Synology will change its stance on whether my DSM needs upgrading to 7.3 since its automatic check has been on its current 7.0-whatever since forever. I hadn't realized until today that it was being held back for upgrades because Synology deems it safe enough... but every single PHP version my 7.0 DSM version apparently 'supports' predates PHP 8.
What the hell is the point of a NAS if upgrading every package/os to the latest supported versions is not even being offered? I found out I need to mass-update my DSM this weekend, lose half the stuff they don't support anymore because of license shit, probably break some other stuff I've got going on the network & webserver side, and generally will not have a nice weekend in the slightest.
For now I've disabled every PHP engine on the custom website profiles I've got in there, but that's about all I can do. I'll just have to hope the handful that are still up make it very hard to identify the PHP entrypoints.
I knew I wasn't on the latest-latest version, but I figured that whatever I was running was at least in a maintenance period still.
Screw you, Synology. I don't get the idiot that decided it was a good idea to hide updates for older NASes by default!
1
u/GrubbyViper382 23m ago
A game i play, path of titians has shut down their servers due to this. Possibly up to a week owner of the game said there's up to 35 vulnerabilities and they have only fixed 2 so far
1
u/watever194 4m ago
Wonder if this is finally the time some of my old clients from 10 years ago email me to upgrade. Code from a 20 years old me was definitely spaghetti.
1
u/All-I-Do-Is-Fap 2m ago
“Couple of days” lol the fact that a lot of ppl think this is an issue means they live in a bubble
966
u/Single-Virus4935 11h ago
This will be way worse than log4shell, which is still a problem, as sooooooo many php servers are plain unmaintained and also php is used on maaany wrbinterfaces for devices like.routers, firewalls, IoT etc. which will never see an update ever. Log4shell was more enterprise and not that ubiquitous like php.