The PHP project is asking administrators to update their servers after discovering two vulnerabilities capable of leading to remote code execution. The alert concerns a language that is very present on the Web, but the figure of 70% mentioned in the press does not correspond to the number of sites actually vulnerable.
In brief
- PHP fixes two critical flaws that could allow remote code execution.
- These vulnerabilities exploit errors in memory management and the internal state of the language.
- The 70% figure refers to the popularity of PHP, not the proportion of vulnerable sites.
- The level of risk depends on the version of PHP used and the configuration of the servers.
- Administrators must install patches and restart affected services.
Two flaws could lead to code execution
The PHP team released several security updates on October 22. His warning leaves little room for doubt: “Critical Remote Code Execution Vulnerabilities: Update Now”. Remote code execution, or RCE, can allow an attacker to issue commands on a server without having legitimate access.
The two main flaws affect the management of memory and the internal state of PHP. Their operation, however, depends on precise technical conditions. It is therefore not a universal attack that would automatically compromise every site built with this language.
THE two critical vulnerabilities rely on different mechanisms:
- The first, referenced GHSA-w8hw-w9fx-j79w, exploits a memory corruption caused when PHP runs out of memory during certain operations. The program can then keep incomplete data before reusing it when the process is stopped;
- The second, identified under the reference GHSA-6wmf-4rv5-p3rp, is based on a global state that has become obsolete. A first operation leaves information in memory, then another request reuses it as if it were still valid.
In both cases, a hacker must succeed in triggering a particular succession of operations. Official notices nevertheless mention a risk of code execution, which explains the level of urgency retained by the PHP project.
The released patches also cover several less critical flaws. They include a bypass of PHP-FPM access restrictions with certain IPv6 addresses, an error in checking TLS certificates and a memory overflow in the OpenSSL component. Issues affecting Phar archives, SOAP protocol and the native MySQL driver have also been fixed.
The 70% figure does not designate vulnerable sites
PHP equips a considerable part of the sites whose server language is known. It is notably behind WordPress, Drupal, Joomla and many custom-designed applications. This broadcast explains why a critical flaw in its engine quickly arouses great concern.
However, stating that 70% of the Internet is threatened remains imprecise. This percentage measures general PHP usage, not the proportion of servers running a vulnerable version. It also does not take into account already patched systems, different configurations, or the conditions needed for each attack.
A site can use WordPress without being directly exposed to these two flaws. According to the on-chain analysis, the risk depends on the version of PHP installed by the host, the active extensions and the way in which requests are processed. Several sites hosted on the same infrastructure can also share an already updated PHP engine.
The situation is more concerning for servers that use an old and unsupported branch. These installations no longer receive official patches. They can therefore combine new vulnerabilities with flaws discovered in previous years.
An update and restart are still essential
Administrators must install the latest security version available for their PHP branch. A simple modification of the files is not always enough: the PHP-FPM, Apache services or other affected processes must be restarted to load the corrected engine.
An inventory should also cover command line interfaces, scheduled tasks, and containers. A server can in fact use several versions of PHP in parallel. Fixing the main site doesn’t necessarily protect an old internal tool or a rarely updated container image.
Shared hosting customers can check the active version in their administration area or request confirmation from their provider. They usually do not have the necessary rights to apply the patch to the system themselves.
No massive exploitation of these two flaws has been established in the official opinions consulted. This absence, however, does not reduce the urgency. The publication of technical details facilitates their study by researchers, but also by hackers. The safest measure therefore remains a rapid update, accompanied by a check of the server logs to spot any unusual behavior.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
