PHP2Shell attacks hit 24 firewalls and one internal server
Dream Research linked the intrusions to a chained PHP and Linux privilege-escalation exploit after scanning about 19,000 exposed firewalls.
Security researchers at Dream Research have confirmed real-world attacks exploiting the PHP2Shell PHP vulnerability, with 24 firewalls and one internal management server compromised, according to byline.network. The attacker chained the PHP flaw with a Linux privilege-escalation flaw to obtain top administrator rights on the servers.
The campaign began with scanning of about 19,000 publicly exposed firewalls before the attacker targeted 240 devices in South Korea, the US, Japan and Taiwan. Among the compromised systems were a firewall and an internal management server belonging to a US government-related organization.
Exposure data published this week points to a large unpatched base in South Korea. Censys reported on October 27 that 508,709 South Korean services had a history of vulnerable PHP versions, and only 19,737 of them, or 3.9%, had moved to a fixed version.
Patch adoption also diverges sharply by branch. Bitsight said on October 29 that 68.6% of hosts on officially supported PHP 8.2 to 8.5 moved to a patched version within a week, compared with 6.4% of hosts on end-of-life PHP 8.1 or lower.
On internal networks, Genians classified 96% of PHP-running devices as vulnerable to PHP2Shell, with 78% running PHP 8.1 or lower and 48% on PHP 5.x or lower. Korean hosting provider Gabia began emergency patching of web hosting servers from the early hours of October 22.
KISA issued update recommendations on October 29 for Palo Alto Networks PAN-OS and some Synology NAS packages addressing PHP2Shell.
Quick answers
What is PHP2Shell?
PHP2Shell is a PHP vulnerability that attackers have exploited in real-world attacks, in some cases chained with a Linux privilege-escalation flaw to gain top administrator rights.
Which products received update recommendations?
KISA recommended security updates for Palo Alto Networks PAN-OS and some Synology NAS packages.
How many Korean services remain exposed?
Censys reported 508,709 South Korean services with a history of vulnerable PHP versions, of which 19,737, or 3.9%, had moved to a fixed version.