Update: This follows my post on CISA confirming PHP2Shell exploitation.
What’s new
Security firm Dream says a suspected China-nexus attacker used a custom PHP2Shell exploit plus a Linux kernel privilege escalation to root 25 servers on Oct. 25, including three in a U.S. government-affiliated network. The targets ran a large vendor’s firewall software (not named) with PHP 8.0.30 on its management server. Then the attacker went after Active Directory and pulled credentials.
Eclypsium’s October InfraTrust Pulse explains why that matters: firewalls, VPNs, ADCs and NAS boxes often embed PHP in their management UIs. You can’t update that PHP yourself. You wait for vendor firmware.
What to do
- Get appliance management interfaces off the internet now.
- Restrict management to an admin network or jump host.
- Watch your vendors’ advisories for PHP2Shell firmware.
God Bless, and Needs Garlic!
