PHP2Shell: What Businesses Need to Know

You may have seen reports this week about a serious new cybersecurity issue known as PHP2Shell.

Two critical vulnerabilities have been found in PHP, a technology that sits behind a huge number of websites and web-based applications.

For most businesses, the important thing isn't understanding the technical detail. It's understanding whether anything you use could be affected, who needs to check it and what your employees should be looking out for.

What Is PHP2Shell?

PHP2Shell is the name being used for two newly disclosed security vulnerabilities in PHP.

PHP is technology that runs behind many websites and online applications. You may never see or interact with it directly, but it can be responsible for processing information, connecting websites to databases and making web applications work.

It is also widely used by platforms such as WordPress, Drupal, Joomla and Magento, as well as hosting platforms and software that businesses may not even realise are using PHP in the background.

The reason these vulnerabilities are considered particularly serious is that, in certain circumstances, an attacker may be able to exploit a vulnerable system remotely without first needing a username or password.

In cybersecurity terms, this is known as unauthenticated remote code execution. In simple terms, it could allow an attacker to make the server running a vulnerable website or application carry out commands it was never supposed to.

Security updates have now been released, but because PHP is so widely used, businesses need to make sure any affected systems are identified and updated quickly.

Why Is This Getting So Much Attention?

There are a few reasons businesses and cybersecurity teams are taking this seriously.

Details of the vulnerabilities appeared publicly before the planned disclosure, giving website owners and software providers less time than expected to prepare. Emergency security updates were released shortly afterwards and the UK's National Cyber Security Centre is advising organisations to take action.

The other challenge is the sheer number of places PHP can be used. A business may not run a PHP server itself but could still rely on a website, customer portal, hosting platform or third-party application that uses it behind the scenes.

If a vulnerable server is successfully compromised, the impact will depend on what that server does and what it has access to. Potential consequences could include disruption to a website or application, sensitive information being exposed, malicious software being installed or the compromised system being used as a starting point for further attacks.

We're also seeing increased activity involving users accessing compromised websites, which creates another risk for businesses even if they don't directly manage a PHP server themselves.

How Could This Affect My Business?

There are two things to think about.

1. Websites And Applications Your Business Uses

Your company website, customer portals or other web-based applications may use PHP without you necessarily knowing it.

If these are managed by a hosting company, web developer or software provider, they should be checking whether their systems are affected and applying the appropriate security updates.

You don't need to become a PHP expert yourself. You simply need confirmation from the people responsible for managing those systems that they have checked.

If you're speaking to a provider, there are three straightforward questions you can ask:

• Does anything you manage for us use PHP?
• Have you checked whether it is affected by these vulnerabilities and applied the necessary updates?
• Have you checked for any signs that the system was compromised before it was updated?

2. Websites Your Employees Visit

There is also a separate risk from websites your employees visit during their normal working day.

If a website becomes compromised, an attacker could potentially change what visitors see, redirect them to another page or present a convincing fake login screen designed to capture usernames, passwords or authentication details.

That means a website somebody has used safely before could suddenly behave differently.

If a familiar website unexpectedly asks you to sign in, redirects you somewhere unusual or simply doesn't look right, stop before entering any information.

Check with your IT team if you're unsure.

What Could An Attacker Actually Do?

The exact impact would depend on the website or application involved and what access the compromised server has.

At its most serious, successful exploitation could potentially allow an attacker to run their own commands on the affected server.

From a business point of view, that could mean an attacker attempting to access information held by the system, disrupt the service, install additional malicious software or use the compromised server to support further attacks.

Researchers examining these vulnerabilities have also demonstrated the potential for information such as passwords, authentication tokens, API keys and certificates to be exposed through one of the identified attack paths.

That is why this isn't simply a case of a website looking unusual or being temporarily unavailable. The concern is what an attacker may be able to access or do once a vulnerable system has been compromised.

What Should I Do Now?

If your websites and applications are managed by other providers, ask them to confirm that they have reviewed the PHP2Shell vulnerabilities and applied any required security updates.

In particular:

• Speak to whoever hosts or manages your company website.
• Check with the providers of any independently managed web applications or SaaS platforms.
• Remind employees to be cautious of unexpected login prompts and unusual website behaviour.
• If something doesn't look right, stop and check before entering credentials or approving an authentication request.

If your organisation manages PHP servers directly, the NCSC recommends identifying affected systems and applying the latest security updates as a priority.

What About Systems Managed By The HBP Group?

We've reviewed the core IT platforms and services we provide and, based on the information available from their respective vendors, we have not identified these specific vulnerabilities as affecting those services.

We've also reviewed our core ERP solutions and have not identified any reported exposure to these specific vulnerabilities.

For customers using the VisiSoft EPOS platform, a security patch was issued within an hour of the vulnerability being published.

We'll continue monitoring vendor guidance and developments and will take further action if anything changes.

If you're unsure whether a website, application or system your business relies on could be affected, or if you have any other questions or concerns, please reach out to your account manager or get in touch with our team.

We'll continue to monitor the situation and update our advice if anything changes.

____

FAQs

Does PHP2Shell Mean My Microsoft 365 Account Is Vulnerable?

Not directly.

PHP2Shell affects systems running vulnerable versions of PHP, rather than Microsoft 365 itself.

However, a compromised website could potentially be used to present a fake Microsoft sign-in page or other phishing content, which is why employees should be particularly cautious about unexpected login prompts.

Is PHP2Shell A Phishing Attack?

No.

PHP2Shell is a vulnerability in the technology running behind websites and web applications. It doesn't rely on somebody clicking a phishing email for the vulnerable server itself to be attacked.

However, the two risks can cross over. If an attacker compromises a website, they could potentially use it to redirect visitors or present convincing fake login and authentication pages.

Could My Business Be Using PHP Without Knowing?

Yes.

PHP can sit behind websites, hosting platforms and web-based applications without the end customer ever needing to know what technology is being used.

That's why we're recommending businesses check with the providers responsible for independently managed websites and applications rather than trying to investigate PHP themselves.

How Do I Know If My Website Uses PHP?

You may not know, and that's completely normal.

If your website is managed by an external developer or hosting provider, ask them to confirm whether PHP is being used and whether the latest security updates have been applied.

Do I Need To Do Anything If The HBP Group Manages My IT?

There isn't anything you need to change to the core services we manage based on what we currently know.

The main area to check is anything managed independently of us, particularly websites, hosting and third-party web applications.

What Should I Do If I See Something Suspicious?

Don't enter your credentials or approve an authentication request.

Close the page and contact your IT support team so they can check it before you continue.

Want The Technical Detail?

Our cybersecurity partners at Huntress are tracking PHP2Shell closely and maintaining a detailed technical breakdown with updates as the situation develops.

Read the Huntress PHP2Shell technical breakdown >