Taggart :ifin: on Nostr: The Phermi Paradox If #PHP2Shell is so gnarly and so many systems are vulnerable, why ...

The Phermi Paradox

If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over?

Couple possibilities:

1. The exploit is still non-trivial and building the full attack chain is taking some time.

This is at least partially true. I've yet to see a fully reliable proof-of-concept exploit that addresses all versions of PHP. Calif and Wiz showed exploit videos against targets. They didn't show what pregaming they did to prepare the exploit for those specific targets. So far, it seems like some prior work is necessary to get proper offsets, heap layouts, and payload shapes to exploit properly.

And that's assuming the mod_php SAPI, which responds differently to this than PHP-FPM.

2. Patching was aggressive and major targets had time to get in front of this.

For larger orgs, I believe this is accurate. The message was clear enough, and there was time enough to get any org with a half-awake IT team to circle the wagons. Patching isn't done, surely, but I think the most enticing targets for notable attacks probably moved quickly.

It's also worth noting that status dashboards like this are mostly a fairy tale. Look at the bottom for some whopper disclaimers. OS backports to versions other than PHP's official patched versions will muddy the picture, as will the 50% of PHP services that don't report versions. I'm not saying most of the internet is patched; I'm just saying

But let's not ignore the alternative:

3: The exploited won't know it's happening and won't report it.

This is hardly a new phenomenon PHP sites have been exploited for years without anyone noticing (see: Slot Gacor). Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.