“The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response

The recent PHP2Shell vulnerability, a pair of critical PHP vulnerabilities with a high CVSS score of 9.2, has raised concerns among security researchers. Despite the panic following its disclosure, the findings suggest that remediation efforts have been slow and insufficient. According to Moshe Siman Tov Bustan of Ox security, "The panic hasn't turned into patching."

Ox's research indicates that as of October 26, five days after the disclosure, 93.6% of servers remain vulnerable. The slow pace of remediation is exacerbated by the presence of more headlines about the issue than actual fixes in the wild. Censys, a security company, reported that only 11.2 million Internet-facing PHP services have been patched, with 32.5 million still running vulnerable versions.

Moreover, 61,303,506 services have yet to be identified, many of which may be running unsupported versions of PHP. Other studies have found similar results, with nearly three-quarters of tracked PHP services advertising unsupported branches, and 73.5% of surveyed services running unsupported versions. As the threat persists, some organizations have taken action, such as the Wikimedia Foundation and Internet Archive, while others have permanently shut down due to the vulnerability.

Governments, including the US, have also mandated PHP2Shell remediation, but the task remains daunting. PHP2Shell attacks are ongoing, and initial attempts have surged to millions within hours of the announcement.