PHP Vulnerabilities Expose Millions of Services to Cyber Threats
Two critical vulnerabilities in PHP have raised alarms, potentially affecting millions of internet services globally.
Two severe PHP vulnerabilities allow remote code execution without authentication.
Approximately 36.7 million internet services may be impacted, with many unpatched.
India ranks ninth globally in services displaying vulnerable PHP information.
A cybersecurity alert has been issued due to two critical vulnerabilities in PHP that could enable hackers to execute code remotely on servers without needing authentication. This alarming situation poses a significant risk to millions of internet-facing services, prompting PHP to recommend immediate action for users.
On October 23, PHP advised users to temporarily disable the session upload progress feature to mitigate another risk related to remote code execution. This recommendation followed an earlier advisory on October 21, which highlighted a related vulnerability. The current issues arise when specific session settings are altered while the upload progress feature remains active. Users who have already disabled this feature are not required to take further steps.
The vulnerabilities, collectively known as PHP2Shell, have raised serious concerns among cybersecurity experts. Aamir Lakhani from Fortinet emphasized that these vulnerabilities present an urgent risk to organizations relying on web applications, customer portals, and websites. The potential scale of exposure is alarming, with Censys reporting around 36.7 million internet services that may be running affected PHP versions, highlighting the widespread nature of the issue.
Further analysis by Qualys revealed that there are approximately 167 million PHP package installations across 12,000 organizations, with a staggering 73% of these installations on internet-facing assets. Saeed Abbasi from Qualys noted that simply applying patches will not suffice for systems running unsupported versions of PHP, as upgrading is essential for long-term security. The findings indicate that nearly all PHP installations are either vulnerable or operating on outdated versions.
According to CloudSEK, Shodan has identified 2.2 million internet-facing services globally that display PHP information, with India ranking ninth at 53,400 services. Out of 36,700 Indian services revealing their PHP versions, around 36,100 are unpatched, including 19,500 that are running versions that have reached their end of life. This situation underscores the urgent need for organizations to assess their PHP installations and take necessary actions to secure their systems.
