Recently, a critical vulnerability known as PHP2Shell has sent shockwaves through the cybersecurity community. Discovered with the assistance of advanced Artificial Intelligence, this zero day flaw in the core engine of the PHP programming language exposes millions of websites to Remote Code Execution and memory disclosure. For our team at Vertex, this event serves as a profound validation of a strategic decision we made over five years ago: transitioning our codebase from PHP to Golang. In this post, we will explore the details of this vulnerability and explain why choosing memory safe languages like Golang can help enhance your overall security posture.
Understanding the PHP2Shell Vulnerability
The PHP2Shell vulnerability highlights the inherent risks in legacy architectural decisions. The PHP language powers a vast majority of the internet, making it a highly attractive target for malicious actors. The recent zero day vulnerabilities stem from how PHP handles memory and out of memory errors.
Because PHP is built on the C programming language, which requires manual memory management, it is susceptible to memory safety issues such as use after free bugs. In the past, the sheer complexity of discovering and chaining these flaws provided a barrier to exploitation. However, as Artificial Intelligence models continue to improve, attackers can leverage Artificial Intelligence to reduce the time and expertise required to turn long standing flaws into devastating exploits.
The Security Advantages of Golang
Over five years ago, Vertex made the strategic move to transition away from PHP and adopt Golang for our core products and services. We based this decision on several key cybersecurity principles that we believe contribute to a stronger defence:
- Memory and Type Safety: Unlike the C programming language that underpins PHP, Golang offers built in type safety and memory safety features. It handles memory allocation and garbage collection natively. This architecture can help minimise the risk of memory corruption vulnerabilities, similar to those seen in the recent PHP2Shell exploit. The latest zero day vulnerabilities identified with the help of Artificial Intelligence prove that Golang has maintained its position as a secure choice.
- Minimalist Architecture: PHP includes a vast array of helper functions and processing capabilities by default, simply because it needs to generally support many capabilities for any developer across web development. This extensive functionality inadvertently increases the potential attack surface. In contrast, Golang operates with a minimalist philosophy. You only import and compile the specific libraries and functions you need and use. This streamlined approach can help significantly reduce the potential entry points for threat actors.
- Compiled Robustness: Because Golang is a compiled language, it produces a single binary executable. This reduces the dependency on external interpreters and shared libraries during runtime, which can help create a more secure environment that resists manipulation.
Protecting Your Organisation from Zero Day Threats
The discovery of the PHP2Shell vulnerability serves as a stark reminder that even widely trusted software can harbour severe security flaws. While no system is impenetrable, adopting secure development practices and choosing robust programming languages are strategies you could apply to help detect and mitigate potential threats. While modernising your technology infrastructure may require an initial investment of dollars and time, these measures contribute to a stronger defence against future vulnerabilities.
When evaluating your own technology infrastructure, you might consider implementing a transition to memory safe languages where appropriate. Regular security audits, penetration testing, and continuous monitoring are also excellent strategies to help improve your security posture.
If you want expertise to know how to protect yourself from zero days, talk to the Vertex cyber experts. Our team of experienced professionals is ready to assess your environment and recommend tailored solutions. Please visit the Vertex Cyber Security website or contact us today to discuss how we can assist you with your cybersecurity journey.