In the dynamic world of cybersecurity, a zero-day vulnerability is one of the most significant challenges an organisation can face. Recently, the cybersecurity community was alerted to a critical flaw known as PHP2Shell, which affects the core engine of the widely used programming language, PHP. Given that PHP powers approximately seventy percent of all websites globally, this discovery is monumental. A successful exploit could allow malicious actors to take control of servers, expose sensitive data, and cost businesses thousands or even millions of dollars in damages and recovery efforts.
At Vertex Cyber Security, our public website operates on PHP. When the news of this zero-day vulnerability broke, our systems were running a vulnerable version. However, we successfully kept our website public and online without falling victim to any attacks. We achieved this by implementing immediate, stringent hardening measures.
In this article, we will explore the nature of the PHP2Shell vulnerability and discuss the defensive strategies you could consider implementing to help enhance your own security posture during similar events.
Understanding the PHP2Shell Vulnerability
The PHP2Shell vulnerability stems from memory safety issues within the core PHP engine. When the system encounters specific fatal errors, it can leave behind a corrupted internal state. Malicious actors can exploit this corrupted state to achieve what is known as Remote Code Execution.
This vulnerability can lead to several severe consequences, such as:
- Unauthorised access to sensitive process memory.
- Exposure of authentication tokens and passwords.
- The ability for malicious actors to execute arbitrary commands without needing to authenticate.
Because this flaw exists in the core language itself, it operates independently of the specific website application you are running. Whether you operate a complex Content Management System or a simple webpage, the underlying infrastructure could be exposed.
How We Protected Our Vulnerable Website
When a zero-day vulnerability is announced, a patch or update is not always immediately available. During this critical window, taking your website offline is one option, but it can severely disrupt business operations. We chose to keep the Vertex Cyber Security website online by applying extra hardening directly to our PHP environment.
By layering additional security controls, we were able to neutralise the threat mechanisms the vulnerability relied upon. If you are looking to bolster your defences, these measures contribute to a stronger defence and are protections you could apply to your own systems:
- Disabling Inputs: We immediately disabled unnecessary data inputs to our website. By restricting the ways external users could send data to the server, we reduced the avenues an attacker could use to trigger the memory errors associated with the vulnerability.
- Blocking Multi-cast Traffic: We configured our network defences to block multi-cast communications. Limiting unnecessary network traffic can help enhance your security by preventing potential lateral movement or coordination by malicious scripts.
- Blocking Upload Sessions: A core component of the PHP2Shell exploit involves manipulating upload progress sessions. By entirely blocking upload sessions, we removed the specific mechanism the vulnerability required to execute successfully.
- Blocking Anything But GET Requests: We restricted all website traffic to accept only GET requests, blocking POST, PUT, and other request methods. This action made our website temporarily read-only. Visitors could still read our content and browse our services, but complex interactions that could alter server states were halted.
These actions demonstrate the value of a defence in depth strategy. While the underlying software contained a vulnerability, the restrictive environment we created around it helped to prevent the exploit from being executed. It is important to note that while these steps are highly effective, you should view them as potential strategies to minimise risk rather than absolute solutions. No single measure can guarantee complete protection, but together, these layers create a formidable barrier.
Prepare for the Next Zero-Day
Cybersecurity requires constant vigilance and proactive management. Relying on standard configurations is rarely sufficient to withstand sophisticated, novel attacks. Implementing robust hardening measures can provide vital time to apply official patches once they become available.
If you want expertise to know how to protect yourself from zero days, talk to the Vertex cyber experts. At Vertex Cyber Security, our experienced professionals can assess your technology environment and help you implement tailored strategies to protect your business. Please contact our team at Vertex Cyber Security today or visit our website to learn more about how we can support your security journey.