This situation stems from the internet's foundational construction, which has utilized rudimentary methods for interconnection, resulting in widespread software containing aging flaws.
The recent PHP2Shell disclosures have brought attention to this issue. Host Brandon Vigliarolo, alongside cybersecurity editor Jessica Lyons and FOSS reporter Liam Proven, discussed the implications.
Jessica Lyons confirmed that the problem is substantial, detailing two related memory safety vulnerabilities within the PHP core. These collectively form PHP2Shell.
These flaws impact every version released within the last decade, tracing back to roughly version 5.4. The general consensus indicates that about 70 percent of all websites operate using this code.
An independent researcher first identified this vulnerability in August. Following a coordinated disclosure process with the PHP Foundation, leaks occurred over the weekend and into Monday. The PHP Foundation issued an emergency warning late Monday, stating, "Hey, we are going to be releasing these emergency patches, so everybody get ready so you can implement them as soon as possible. It's very serious."
Patches were released by Wednesday, prompting a mass patching effort before attackers could exploit them. However, legacy servers running older versions cannot apply these fixes, leaving them vulnerable.
Exploiting these memory corruption vulnerabilities allows an attacker to manipulate PHP's trusted memory, potentially leading to remote code execution. This could enable the takeover of websites or data theft while users remain unaware.
AWS reported that exploitation attempts were observed at least four days prior to the patches being issued. However, as of Friday, security experts cited by the Foundation have noted no evidence of successful exploitation, though this does not signal complete safety.
Liam Proven provided historical context, noting that the original creator of PHP, Rasmus Lerdorf, stated in an early interview about it, "I really don't like programming. I built this tool to program less so that I could just reuse code."
Lerdorf initially developed it as a small tool allowing HTML macros for his site in about 1993. He later mentioned in another interview, "I don't know anything about writing programming languages. I'm just improvising this as I go and people seem to like it."
This architecture represents an older paradigm, embedding programs within the markup language, contrasting with modern systems where content management systems assemble pages from databases.
The persistence of these issues suggests that remediation will be a long-term undertaking, potentially spanning years, particularly for governmental and local entities whose IT resources may not be closely monitoring these technical developments.
