PHP vulnerability post-mortem reveals bug was known two years ago - Small team of maintainers knew of the issue before it was made public, as new PHP2Shell chained exploit ravages servers

A remote code execution vulnerability in PHP, the engine behind roughly 70% of websites, is being exploited through the PHP2Shell exploit while the PHP Foundation's post-mortem shows its maintainers knew about the flaw for two years. The bug affects servers running unpatched PHP, and 73% of installations online at the time were running end-of-life versions with no active support.

The root cause is an old architectural decision in PHP's error handling. When a process runs out of memory, it calls the C function longjmp(), which jumps execution elsewhere immediately. If that jump happens while a data structure is being built, such as an array entry or an object, the incomplete data stays on the memory heap, and the engine's cleanup-end-exit mechanism later acts on those inconsistent leftover bytes. An attacker who injects the right content into a web request can use that to run code with PHP's permissions.

Exploiting it requires knowing the exact version and build of PHP in use, so it is not a simple matter. The blast radius is wide, with tens of millions of vulnerable servers, many running the same exact version. After the vulnerability became public, many sysadmins turned off version number reporting so as not to aid prospective hackers.

The PHP Foundation's post-mortem says the team knew of the issue for two years but did not immediately see it as a cause for concern, and went back and forth on the best fix while maintaining compatibility with third-party extensions. The team admitted management mistakes, but it is a small outfit with one full-time employee and 14 part-time contractors maintaining one of the most widespread pieces of software on the internet.

Patching is a point update, possibly with a restart of some services, and the maintained branches are PHP 8.1 through 8.5. Since the PHP Foundation published source code patches for 7.4 up to 8.1, others have built fixes for older versions: Ondrej Sur of Debian has packages covering PHP 5.6 to 8.1, and CloudLinux and AlmaLinux have produced backported fixes. Commercial vendors including Ubuntu Pro and Zend released packages down to PHP 5.5.

The PHP2Shell campaign has at least one high-profile case, a campaign that chained the PHP vulnerability with Fragnesia (also called Dirty Frag) to gain kernel-level access to 25 servers seemingly linked to the U.S. government. BitSight had recorded copious PHP2Shell intrusion attempts across its monitoring fleet from many distinct origins as of October 29, and its dark web forum sleuths found no one-size-fits-all exploit package available at that date. Censys estimated 45.7 million vulnerable installs out of 119 million total after the October 19 reveal, a figure that had dropped to around 29 million, though 62% of PHP servers it consults do not report version numbers at all. WAFs such as Immunify360, CDN offerings from Cloudflare and Fastly, which added detection of PHP2Shell to their rulesets, and server-level suites like CrowdStrike can block malicious activity, and Palo Alto Networks issued an advisory for products powered by its PanOS system.

More cybersecurity news from TechManNews.