r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

318

u/MaxRD 11h ago

Couple of months, more likely. The vast majority of exposed and vulnerable sites are managed by people who will not be aware of it until after they get compromised

43

u/ILOVECOCKSTARGAMES 9h ago

If someone hosts a site how do they get their info compromised from this? And will there be data leaks on other sites members?

98

u/tommyk1210 8h ago

This is basically an exploit that allows an attacker to perform remote code execution (RCE). That is one of the worst exploits you can have.

An attacker, under certain circumstances they can induce, can basically get a full “shell” (terminal/command prompt equivalent) on the target server.

This means they can, for example, tell the server to send all credentials on disk to a remote server, or find the database password somewhere on config/disk and login to the database, then dump the whole thing to some remote server.

It’s bad.

20

u/MrTastix 7h ago

Yeah, I am a member of forums which haven't been active in years but are still around for prosperity reasons.

There's no good way to contact the hosts of these people to let them know, that's how inactive it is. The admins likely already know about this given their professions but they have to still remember all the projects they worked on 15 years ago with PHP to go back and fix it.

25

u/tommyk1210 7h ago

Nah, plenty of these admins were teens setting up web forums in the 2000’s, that was me too. Some, like me, will have made a career of it but just as many are happy to pay the modest hosting fees and have zero real idea what they’re doing.

5

u/Atario 3h ago

prosperity

Posterity, unless you're implying more than I thought

4

u/peeinian 5h ago

They can just open a reverse ssh connection and peruse your server directly.

1

u/oops_i_made_a_typi 50m ago

does this basically mean ppl should be resetting all their passwords soon?

0

u/ILOVECOCKSTARGAMES 5h ago

I’m glad most sites shut down in time, but if the vulnerability was already existing then why are people mad at the guy who “leaked” the patch and how can we be sure some websites haven’t been compromised already without the owner knowing

5

u/tommyk1210 4h ago

By announcing a time in which the patch was to be released they allowed people to prepare. At my work, for example, we have hundreds of services across thousands of containers that needed updating.

By announcing that time, it put us AND hackers on equal footing.

But then the patch got leaked early, people weren’t as prepared. But you can bet anything the hackers were.

The php2shell exploit can pwn a server in as little as 30 seconds. So even a few hours head start might lead to thousands of compromises.

As for it existing for years, it has, but there’s no evidence the bug was ever found before. Basically all the software you ever use will have bugs, and very few really get reported. It took 20 years to find this PHP bug.