Observations from Running stealmybitcoin.com | Pavursec
pavursec.com
Last week, I saw an article on the front page of the New York Times website reporting that a critical vulnerability in PHP had been found. The article, and others like it, claimed any attacker could achieve arbitrary remote code execution on any of the millions of running PHP services worldwide simply by sending a few unauthenticated web requests that exploited the PHP2Shell vulnerability.
  • I Cast Fist@programming.devEnglish
    21·
    6 days ago

    Was PHP2Shell actually exploitable outside of a lab environment?
    Yes

    From over 10k unique IPs:

    Only two IPs managed to trigger the print-flag executable and only one person did so in such a way that data was exfiltrated successfully from the server.

    PHP2Shell is the real deal. It’s an exploitable vulnerability and a sufficiently motivated adversary, with the help of AI, can absolutely use it to hack a website even when they do not have direct access to memory addresses or the physical server to tailor their exploitation pathway.