In the brief for Thu, Oct 22

PHP flaws that let attackers run code without signing in are exploited

Oct 22, 6:00 a.m. ET

Affected: PHP 8.2 through 8.5 before the Oct 21 releases, and older versions back to 5.4, which Wiz says are affected too. All versions and fixes

Two flaws in PHP’s core can let an unauthenticated attacker run code, and the PHP team says every PHP installation serving web requests is at risk. Amazon says the flaws, which their finder Wiz calls “PHP2Shell,” are now broadly exploited, and its honeypots logged a first attempt on Oct 17, before the fixes were public. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both, and PHP 8.1 and older get no update from the PHP project.

Both flaws are in how PHP handles memory when a request fails, Cloudflare explains. In , running out of memory interrupts PHP while internal request data is only partly set up, and cleanup may then treat that data as valid. In , internal state outlives the memory behind it, and a later request to the same worker may use it. PHP rates both 9.2 under CVSS 4.0 and sees the most risk in Apache’s mod_php, where a request can set off the attack before any application code runs.

The flaws are in PHP itself, so sites built on it are exposed whatever their own code does. Wiz, which found them with Calif and OpenAI, says every PHP version back to 5.4 has at least one, and it showed unauthenticated code execution on WordPress, Drupal and Joomla. The PHP team lists PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed among the setups at risk.

Amazon says the Oct 17 attempt came from a commercial anonymization network while the flaws were still under embargo, and it doesn’t know how the attacker learned of them. More attempts from other anonymized addresses followed from 10 p.m. ET on Oct 20, though Amazon says it’s unclear whether any would have worked on real systems. Cloudflare says the flaws leaked before release, and it saw attack traffic against its customers that changed to try to get past its rules.

Linux distributions and long-term support vendors got the patches in advance, the PHP team says, and it published minimal source backports for PHP 7.4, 8.0 and 8.1. Its interim settings reduce exposure to specific attack paths but don’t make a server safe. CISA, which hadn’t seen exploitation when it published its alert, says to take systems that can’t be updated offline until they’re patched.

CVE
Vendor: PHP

What to do

8 steps

1Inventory every system running PHP, including products that bundle it, since CISA says its presence may not be directly visible.
2Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a distribution’s patched package, starting with internet-facing systems.
3For PHP 8.1 and older, get backported fixes from a distribution or long-term support vendor, or upgrade to a supported version.
4Take PHP systems that can’t be updated yet offline until they’re patched, as CISA advises.
5For any that must stay online, apply the PHP advisory’s interim settings for each flaw and restart every worker. They reduce exposure but don’t make a server safe.
6Starting from Oct 17, look for POST requests carrying PHP_SESSION_UPLOAD_PROGRESS in form uploads, and investigate traffic from the addresses Amazon lists rather than blocking them.
7Watch for unusual multipart requests followed by memory-limit errors or repeated 500 server errors, and for oversized or malformed PHPSESSID cookies, signals Wiz says can guide an investigation.
8Check web servers for PHP workers that launch shells or download tools, and for other unexpected processes or file changes.

Affected and fixed versions

Product	Affected	Fixed
PHP 8.5	Before `8.5.12`	`8.5.12`
PHP 8.4	Before `8.4.27`	`8.4.27`
PHP 8.3	Before `8.3.36`	`8.3.36`
PHP 8.2	Before `8.2.35`	`8.2.35`
PHP 8.1 and older	Back to `5.4`, Wiz says	No PHP release. Backports from distributions or long-term support vendors, or the PHP team’s source backports for `7.4`, `8.0` and `8.1`

Product
PHP 8.5
Affected
Before 8.5.12
Fixed
8.5.12
Product
PHP 8.4
Affected
Before 8.4.27
Fixed
8.4.27
Product
PHP 8.3
Affected
Before 8.3.36
Fixed
8.3.36
Product
PHP 8.2
Affected
Before 8.2.35
Fixed
8.2.35
Product
PHP 8.1 and older
Affected
Back to 5.4, Wiz says
Fixed
No PHP release. Backports from distributions or long-term support vendors, or the PHP team’s source backports for 7.4, 8.0 and 8.1

Indicators

IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
IP address		Oct 17 attempt, per Amazon; commercial anonymization network, so investigate
IP address		Oct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP address		Oct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP address		Oct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP address		Oct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP address		Oct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block

IP addressOct 17 attempt, per Amazon; commercial anonymization network, so investigate
IP addressOct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP addressOct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP addressOct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP addressOct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block
IP addressOct 21 attempt, per Amazon; shared infrastructure, so investigate rather than block

Timeline

Oct 17Amazon’s honeypots log an exploit attempt from a commercial anonymization network while the flaws are under embargo.
Oct 20The PHP team announces a critical security release for Oct 21.
Oct 20Amazon finds the earliest of several exploits around 10 p.m. ET, and more attempts hit its honeypots over the next six hours.
Oct 21The PHP team ships the fixes at 10 a.m. ET, Wiz publishes its research and CISA says to patch immediately.
Oct 21Amazon says the flaws are broadly exploited.

Sources

Amazon researchPrimary source aws.amazon.com
PHP advisoryPrimary source php.net
Wiz researchPrimary source wiz.io
Cloudflare noticePrimary source blog.cloudflare.com
CISA advisoryPrimary source cisa.gov