Think you are safe from PHP2Shell because you updated your PHP version?

Think you are safe from PHP2Shell because you updated your PHP version?

Think again….

AWS detected being hit with PHP2Shell 4 days before it was disclosed to the rest of the internet.

This means malicious parties had days to carry out attacks unabated.

The good news is, if you use something like Docker, when you do your next deployment, whatever malicious changes they made will likely get blown away.

If, on the other hand, you are nursing along dedicated servers or even EC2 instances, then whatever malicious payloads they might have dropped in there could still be waiting for the signal to attack.

I would recommend fresh builds from the source just to be safe.

Just because you use Docker, don’t think you are completely in the clear.

Malicious parties could have grabbed your credentials in that window.

A malicious party could easily have printed out your env vars to a file, then zipped your entire codebase and had it posted to an endpoint they control.

For this reason, I suggest doing a complete cycling of credentials.

Do with that recommendation as you wish.