While there were credible reports over the weekend of exploitation in the wild of the two PHP2Shell bugs that caused all the fracas last week, as of the afternoon of Oct. 26, there are no known public reports of successful exploitation — and no widespread exploitation.
Translated: There could very well be a public exploitation on a large enterprise, it just hasn’t been reported yet.
Major research groups also walked back original fears of widespread exploitation of PHP2Shell on Oct. 26.
The first was by Palo Alto Networks Unit 42 which, in an Oct. 25 blog, retracted an Oct. 23 statement that said that an attack against a European government agency was related to a vulnerable PHP2Shell application. In the update, Unit 42 said the cybersecurity firm was unable to confirm that initial access was associated with either of the two PHP2Shell bugs.
A second cybersecurity company, Sophos, said in an Oct. 26 blog that as of this reporting, PHP2Shell had yet to become the mass exploitation event many in the industry braced for.
“We're all barely a week into the entire industry throwing their token budgets at PHP2Shell, and we're still here, for now,” said Jake Knott, head of threat intelligence at watchTowr. “The question on everyone's mind this week: Is exploitation happening in the wild? But the real question is actually whether reliable, indiscriminate exploitation is happening, and for now, the answer is a firm 'No.'”
Denis Calderone, chief technology officer at Suzu Labs, has some good research on what actually is going on. As of the morning of Oct. 26, Calderone said the Delft Threat Intelligence Lab's honeypots and network telescope had recorded more than 50,000 PHP2Shell exploitation requests from more than 600 addresses in 70 countries.
The pace has picked up, not slowed down: the busiest hour of the entire event so far was the morning of Oct. 26, with more than 5,100 requests in a single hour, and 171 of those source addresses have moved past probing and are sending actual code or droppers.
“The fact that there are more payloads being seen probably means that someone has something that they think is working,” said Calderone. “Still, a lot of attempts, a working exploit on a specific server, and a mass-exploitation event that succeeds across many configurations are three different things. That distinction matters for reading the threat accurately, but it does not change the response. Teams should still prioritize patching and upgrading without question.”
Calderone said Suzu Labs is tracking the Perplexity findings that an Oct. 26 BleepingComputer article referenced, but they have also been tracking the Delft numbers. Calderone said Delft has their finger on the pulse, measuring the noise, the sheer volume of scanning, while Adel Karimi at Perplexity recorded 35 working shells on unpatched PHP 8.4.26 under Apache mod_php by way of his honeypot farm.
“He has packet-to-process evidence tying each captured request to a shell spawned by an Apache worker,” said Calderone. “Karimi is careful to point out his setup was a deliberately favorable single-worker configuration, so it proves exploitation is real, not that it works reliably everywhere.”
Suzu Labs was also following Beazley's Oct. 25 update that said Trail of Bits has a working exploit that has not been released publicly. Calderone said Trail of Bits CEO Dan Guido has since gone further and described it as "production-grade," working against stock production configurations with ASLR enabled, multiple workers, and normal memory limits, under load, on both Apache mod_php and nginx PHP-FPM, on ARM64 and x86-64, and with a chain that ends in root.
“If that holds up and someone weaponizes it against stock WordPress, this is going to be a much bigger mess,” said Calderone. “I still agree with the patch-now guidance from CISA, the NSA, and the FBI. However, this has not turned out to be the ‘the internet is burning’ moment we were worried it might be when the news of these vulnerabilities first dropped last week.”
John Gallagher, vice president at Viakoo, added that these PHP2Shell bugs will have a very long tail. Gallagher said he expected many months of seeing new ways the PHP bugs have been exploited, but there’s still no credible report of public exploitation.
“While we are now seeing the first live reports, the concern for CISOs should be on systems that cyber criminals have used PHP2Shell to gain access but are quietly waiting and choosing carefully their time of attack,” said Gallagher. “Especially with OT and IoT systems the ability to ‘live off the land’ and have long term unmonitored persistence to act as a friction-free launch point to pivot laterally into other parts the enterprise. That's why ensuring all systems are on the latest firmware version is critical.”
