PHP2Shell
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
[…]
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
[…]
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.
Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s
php.inifile, it might be worth turning off multipart uploads for now.
Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.
Add to php.ini:
session.upload_progress.enabled = Off
Add to .htaccess:
<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If>
