PHP2Shell: a chained exploit takes over 25 servers, some US government
Follow-up to Thursday Oct 29: PHP2Shell cleanup is far from over, and experts warn of a 'vulnpocalypse'Follow-up to yesterday's token on the PHP2Shell cleanup. PHP2Shell is the serious flaw in PHP, the language behind about 70% of websites. AI helped find it, and attackers moved fast. In our first edition, it had already pushed UK government services offline.
Now a post on the Dream Group blog describes a chained exploit, where several weaknesses are combined into one attack. It says the attack "rooted" 25 servers, meaning it got full control of them, including US government servers. The post got 314 points on Hacker News. For now, we only have the headline facts: we do not know which agencies were hit or what data was exposed.
The Center for AI Safety newsletter also picked up the mood this week, with the title "AI-Driven Cybersecurity Issues Heighten Fears of 'Hackpocalypse'". The flaw is known and patches exist. The danger now is everyone who has not patched yet.
In just over a week, this flaw went from UK government outages to reported full takeovers of US government servers. If you run a website or a server with PHP, check your patches today, not next month.
