r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

40

u/SqeeSqee 12h ago

I keep seeing news about this. But I am very computer term illiterate. Even eli5's are too complicated. Why is this only affecting EU and not US?

133

u/TheOwlMarble 11h ago edited 9h ago

It's not just the EU, but an EU group made a comment on it.

ELI5: all PHP servers versions 5-8 can be fully taken over with trivial effort from anywhere in the world due to a 9.2/10 severity vulnerability. A patch exists, but PHP servers are often very old and may not be maintained, so a lot of these servers are about to join botnets or be ransomed.

25

u/SqeeSqee 11h ago

Whats the difference  between a PHP server vs a regular server? Why would they join a botnet? Is it because a bot can just hijack the servers now? If they get hijacked is it too late to update them with the fix?

71

u/SubmergedSublime 11h ago

Server is a general term for a computer listening to the Internet, and waiting to respond when someone asks for something (“serving it” if you will.)

You can code that server in literally any computer language. It just has to be able to listen for web requests: no one else cares what language it is written in provided it can listen and serve.

PHP is a very common one, and was especially common in past decades. Which is a reason this bug is especially hard: it impacts a lot of servers and hardware that were written ten years ago, still exist, but haven’t been maintained or updated in years. Or are maintained, but rely on other old stuff so they can’t easily be updated as that stuff breaks.

So “PHP servers” is a huge chunk of the internet connected world. (Python, Go, and JavaScript are other super common languages for servers. They all the same basic tasks. Each language has its pros and cons for the ease of developers, but the end result is effectively the same from the outside)

15

u/TheOwlMarble 11h ago edited 10h ago

A server is just a computer that takes requests from other computers and responds to them without human intervention.

There are several programs that can do the actual request processing. PHP is one of them, powering up to 80% of servers. NodeJS (common for a lot of modern websites) is another. As this is an issue with PHP, NodeJS servers are untouched.

As for botnets, it's common for state-sponsored hackers to quietly take over vulnerable servers and then use those servers at a later date to attack other computers. Private hackers may also use botnets to mine crypto or could just use this vulnerability to hold servers for ransom.

Extricating an infected server from a botnet is often doable if you have physical access, but some are very very hard to expel and may require wiping the hard drive.

3

u/BufferUnderpants 10h ago

To add, PHP is the underlying software of some very widely used applications, notably Wordpress, which is used to display the blogs and webpages for private individuals, small businesses and local government agencies all over the world.

A copy of Wordpress running on some version of PHP has been set up to run hundreds of thousands of times independently, by unrelated people, as it was the cheapest option available to have a webpage like this.

The underlying computers will be left exposed by this vulnerability, as it allows attackers to run their own code in them.

3

u/datskinny 11h ago

PHP servers are web servers that host sites made with PHP. But PHP is not the exclusive language to write webpages in, so there are other servers hosting those. Once compromised, joining botnets is just one of the use cases.

13

u/Thepumpkindidit 11h ago

Is it possible for someone to use this exploit for good. As in use the vulnerability to take over a website and upgrade the PHP for them?

24

u/xchaibard 11h ago

Update? Not really.

Just Take the server down so that someone notices it's vulnerable is probably the best option.

Whenever someone asks me at work what an unlabeled, apparently ignored server does or who owns it, or if it's even still being used, I tell them to just turn it off and see who shows up. If no one shows up in a week they can decommission it because it's obviously not being used for anything important lol

13

u/BorgDad42 10h ago

Ah, the time tested "Scream Test". Turn it off and see who starts screaming

6

u/oddsnsodds 11h ago

Remote updates that disable your connection after the update can be disastrous

2

u/ShadyGuyOnTheNet 9h ago

Well if it wasn’t being cared for anyway, better dead than bot net.

6

u/DiamondIceNS 10h ago

Theoretically, sure.

In practice, updating a major version of PHP like v7 to v8, or way worse, v5 to v8 (v6 was skipped, it's a long story) is not trivial. If you upgrade the PHP version, but your website uses old-style code that the newer version of PHP ripped out for being outdated, your site just breaks. Ask me how I know...

I suppose you could, if you were so inclined, have an LLM auto-migrate the problematic code. But now we're out of cheeky benevolent white hat hacker territory and into "idiot hacker dumps buckets of money on strangers for fun" territory.

3

u/DragonSlayerC 7h ago

Why is it not a 10?

6

u/TheOwlMarble 7h ago edited 7h ago

PHP self reported it as 9.2, but watchTowr has disputed that, calling it a 10. As I understand it, the discrepancy is based on disagreements of how easy it actually is to cause the memory corruption issue.

I'm inclined to believe the 10 because PHP has known about this since 2024 and didn't deal with it, in part, because they themselves couldn't figure out how to attack it, demonstrating that they are not the best judges of this.

1

u/00DEADBEEF 10h ago

so a lot of these servers are about to join botnets.

It's worse than that. The exploit gives an attacker a shell, so they can run any command, which means exporting data such as the entire database, or file uploads in private systems, is very easy.

15

u/Stilgar314 11h ago

Who says is only affecting EU? 

0

u/SqeeSqee 11h ago

Most articles I see only mention EU sites needing to be updated. I don't see anything about north or south americas

25

u/Horat1us_UA 11h ago

It’s just EU have institutions that actively informing about the issue 

9

u/Steak_Knight 11h ago

We used to have those too 😭

16

u/SubmergedSublime 11h ago

Am EU company: our regulators and governments are broadcasting it so naturally we listen harder. US government hasn’t said much at all so they’re listening less. Exact same impact to everyone from anywhere. Every PHP server is in severe risk. Which is a huge number of devices.

18

u/Steak_Knight 11h ago

US government is busy investigating vaccines and how to build a swimming pool

3

u/SqeeSqee 11h ago

Thanks that was easy to understand.

11

u/grekster 11h ago

It affects everyone

30

u/kwartel 11h ago

It’s affecting everybody. The most simple explanation: most websites use a programming language called PHP. Every version of that language released in the last 20 years has an issue where with a rather simple trick, hackers can access the server the website is running on. Once they are inside, depending on further measures the people setting up the server took, the attacker can access customer data, or change the website.

See this like finding out that the most popular door lock has a neat little trick which takes you 3 seconds to lockpick any door in the world. But because this is the internet, you also can be at the front door of every house in the world in milliseconds

9

u/PM_ME_SAD_STUFF_PLZ 11h ago

You basically described the fob locks that most new apartments have that allow for the lock to be open via a paper clip into the weep hole

2

u/WloveW 11h ago

Good to know. When all the apartment lock apps get bricked everyone can still get in! Well maybe not good everyone can get in...

0

u/PM_ME_SAD_STUFF_PLZ 10h ago

There's a shunt fix but most apartments haven't installed it

2

u/11711510111411009710 8h ago

Ah, well that's terrifying to learn.

2

u/comicsnerd 10h ago

US is just waking up.