Organisations across the European Union (EU) are leading the charge to address the PHP2Shell vulnerabilities, with patch rates hitting about 50% of exposed hosts in the Netherlands, the DACH – Austria, Germany and Switzerland – countries edging closer to 40%, and Belgium, Bulgaria, Czechia and Finland hovering at around 30%.
However, British organisations are lagging behind, with barely a quarter of exposed hosts identified as located in the UK patched, while in the US things are moving even slower, with just under 20% of hosts now secured.
Globally, as of 12pm on Monday 26 October, 412,000 publicly accessible PHP hosts were patched, representing about 19% of the visible total.
This is according to live data provided by UK-based cyber startup Infrawatch, which has been tracking PHP2Shell patching rates since last week.
Meanwhile, evidence is stacking up that successful real-world compromises of PHP2Shell are now a reality. According to Bleeping Computer, a Perplexity researcher confirmed they observed remote code execution (RCE) exploiting PHP2Shell after setting up honeypots running a vulnerable version of PHP.
“The news that the PHP2Shell vulnerabilities are now being successfully exploited in the wild isn’t surprising, but it adds even great urgency towards patching,” said Keith Simpson, group operations head at Converged Solutions Group, an Aberdeen-based managed services provider (MSP)
“When major vulnerabilities are disclosed, threat actors move quickly to find ways to exploit them, and AI is now accelerating these efforts. The gap between disclosure and exploitation is shrinking and is often even shorter than the time organisations require to apply patches.
Simpson warned: “While websites have been taken down across the globe, this is not a long-term solution. Many organisations will still not have patched, and they cannot overlook the threat. They must act today.”
This said, confirmation of successful PHP2Shell exploitation – even in a non-impactful honeypot environment – strongly suggests that threat actors have likely already compromised vulnerable real-world systems.
Over the coming days and weeks, this likely means that the opportunistic scanning activity seen to date will begin to morph into web shell deployment and credential theft, followed by brokered access sales to other cyber criminals, and ultimately, a spate of ransomware activity.
Business analysis firm Moodys said that observed exploitation seemed to be originating from multiple threat actors, and exposure is likely to remain uneven, with SMEs with more limited cyber postures facing greater challenges in identifying and fixing vulnerable instances.
This, said Moodys, could increase the likelihood of a ‘long tail’ of individual cyber compromises affecting organisations for months to come.
And according to threat intel company Cyfirma, there is also now evidence that PHP2Shell is attracting the interest of nation-state affiliated threat actors. The firm’s researchers said they were confident that a North Korean-nexus threat actor associated with the infamous Lazarus Group is “actively staging a global offensive campaign” against vulnerable, internet-facing PHP runtimes.
In addition to merely applying the patches, this means security teams should also be activating threat detection and response procedures to ascertain whether or not a breach is in progress.
