Installing a security update is not enough to address "PHP2Shell," a critical vulnerability in the web development language PHP, according to a new advisory. Companies must also confirm that the fix is actually running in their services and search for signs of a breach.
Fortinet, the global security company, issued the recommendation on the 27th in a guide to responding to PHP2Shell. The name refers to two vulnerabilities found in the engine that runs programs written in PHP. If an attacker executes commands on a server remotely without logging in, sensitive information and website files could be exposed.
The vulnerability was rated 9.2 out of 10 under CVSS 4.0, the severity assessment standard, placing it in the "critical" category. Updating widely used website-building tools or plug-ins such as WordPress and Magento does not fix a defect in the engine itself.
Fortinet laid out a four-step response, running from taking stock of affected systems to investigating whether a breach has occurred. The first step is to identify the systems that run PHP, including servers and sites that are not on management inventories, as well as any internet-facing services. Companies should then confirm the PHP version used by each service, who is responsible for it and whether the update has been applied.
Once the update is installed, administrators should verify that services are actually using the patched version of PHP and that no older processes are still running. Installing the update does not mean the fix takes effect immediately. Some vendors also apply only the security fix to an existing version, so companies should ask their suppliers directly whether the patch has been applied.
Stopgap measures are needed if an immediate update is not feasible. Compatibility testing, scheduling the work and restarting services all take time, leaving servers exposed to attack in the interim. For that period, Fortinet suggested enabling "virtual patching," which blocks known attacks at the network level, along with an intrusion prevention system (IPS) and a web application firewall.
Finally, companies should investigate whether an attacker has already gotten in. Installing an update does not remove an intruder who is already on the server. Administrators should look for altered files and abnormal outbound connections. If a breach is suspected, evidence should be preserved and any mechanisms the attacker left behind to regain access should be found.
