On Friday, the CISA sent out an announcement involving critical vulnerabilities in PHP that required immediate patching. You might not run PHP yourself, but that doesn’t mean you’re safe from PHP2Shell.
Your SaaS provider might use PHP. Your hosting provider might manage PHP runtimes on your behalf. A third-party application could bundle PHP inside a container or software package you didn’t know existed. This is what makes PHP2Shell a supply-chain security concern. The vulnerability sits in the PHP runtime itself, so an application can inherit the risk even when its own code is secure.
What You Should Do
If a vendor manages the affected infrastructure, you need to know whether it has applied the fix and whether your data or systems could have been exposed before remediation. What to ask:
- Do you use an affected PHP runtime?
What to expect: A clear statement of the systems assessed, the affected components identified, and the evidence behind the vendor’s conclusion. - Have you patched the actual PHP runtime?
What to expect: The deployed runtime version or applicable vendor advisory, evidence of the update, confirmation that the relevant processes were restarted, and verification that the fix is active. - Could your data or credentials have been exposed?
What to expect: A written impact assessment that separates confirmed findings from suspected exposure and inconclusive results. - What are you doing to detect suspicious activity?
Ask your vendors whether they have reviewed web server and application logs for unusual requests, unexpected PHP worker errors, unexplained process activity, and suspicious outbound connections. They should also explain whether relevant logs were available for the period under investigation.
- When can you consider the issue resolved?
