DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.
Special Bulletin: PHP2Shell, Critical PHP Vulnerabilities Developers Need to Know About
•Tanya Janca | SheHacksPurple•Season 2
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
0:00
|
6:09
Two critical PHP vulnerabilities have been disclosed, and even applications written with secure coding practices may be affected.
In this special bulletin of DevSec Station, Tanya Janca (SheHacksPurple) explains PHP2Shell, why vulnerabilities in the underlying PHP runtime can put otherwise secure applications at risk, and what developers and organizations should do to protect their systems.
In this episode, we cover:
Why secure application code alone cannot protect against vulnerabilities in the underlying runtime
What developers and operations teams should check in their PHP environments
Why patching, rebuilding containers, and redeploying applications matter
Why a web application firewall is not a substitute for applying security fixes
What WordPress.com has announced about protections for its hosted websites, and why people using other WordPress hosting providers should check separately
The key takeaway: secure coding is essential, but we also depend on the security of the languages, runtimes, libraries, and infrastructure our applications run on (also known as our software supply chain).
A big thank you to the PHP maintainers, security researchers, and hosting teams doing the work to keep the ecosystem secure.
This is a special security bulletin, separate from our regularly scheduled Season 2 episodes.
DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software.
Train with Tanya: Want to bring practical, hands-on secure coding, application security, or AI security training to your team? Learn more at SheHacksPurple.
Hi, this is Tanya Jenka from DevSecStation, and I'm interrupting our regular podcast schedule with a short security emergency bulletin because these two critical vulnerabilities cannot wait. PHP released two critical vulnerabilities, and if you develop or maintain PHP applications, I need you to listen to the message that follows. If you have a website or application running PHP, you need to pay attention to this. Yesterday, the PHP team released emergency patches for two critical security vulnerabilities that could allow an attacker to remotely execute code on your server without logging in. They're called PHP2 Shell. And the vulnerabilities are CVE 2026, 1009618, and 1009619. Both have a critical severity rating of 9.2. And this is the thing that makes this really important and really scary. These vulnerabilities are not in your application. They are in PHP itself. So you could have done every single thing right as a developer. You could have perfect input validation, parameterized queries, strong access control, and great secure coding practices, and your application could still be vulnerable. Why? Because these are memory safety vulnerabilities inside the PHP runtime. One involves what happens when PHP runs out of memory at exactly the wrong moment. The other involves PHP accidentally using memory that's already been freed. So use after free is what that's called. In certain circumstances, an attacker can exploit these problems to execute their own code on your server. In one demonstrated attack against Apache with mod underscore PHP, the exploit could happen before the application code even started running. So all that beautiful input validation that you wrote, it doesn't get to help you. So now let's talk about what you should do about this. First, find out if you are running PHP, 69% of the entire internet is. Not just your main website. Check your containers, older applications, third-party products, and anything else that might have PHP bundled inside of it. Second, please update immediately. Cancel whatever meeting you're about to go to, whatever you are about to do, do it literally right now, please. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you are using PHP 8.1 or older, you are running an unsupported version, no comment. Check whether your operating system vendor has provided a backported security fix or upgrade to a supported release. And if you use containers, make sure you rebuild and redeploy them with the patched runtime. Updating your source code alone won't fix this. Okay, third thing to do. Please don't assume your web application firewall is going to save you from this. A WAF might help block certain exploit attempts, but it is not a complete fix for a vulnerability inside the programming language runtime. This is very different than most vulnerabilities we've previously seen. The PHP project has been extremely clear. You must update. Okay, another interesting part of the story. Of course, AI was evolved. Of course it was. Researchers at Wiz used AI models to help find, investigate, and validate these vulnerabilities. And I feel that that is important because it shows how AI can help security researchers find serious problems in the foundations of software. But on top of that, the really big scary lesson here is that secure coding doesn't end with the code that you personally wrote. The entire supply chain matters. So your application depends on programming language, runtime, frameworks, libraries, and all sorts of other components that make up your supply chain. And any one of those can have vulnerabilities. And that is why secure software development includes keeping your dependencies and runtimes updated, understanding the entire package that you are deploying, and having a way to respond quickly when something serious is discovered. At this point, I want to acknowledge the PHP maintainers and security team here because obviously they have been working around the clock to fix this. Fixing critical vulnerabilities and software that so much of the internet depends on is difficult work, stressful work, high pressure work. And they have coordinated these emergency releases to protect users. So please, if you're running PHP, check your versions, get those patches applied right away. And if you are a developer who does not control production updates, send this video to the people that do. Just to be clear, the lesson here is not that secure coding doesn't matter because it absolutely does. The lesson here is that even excellent application security practices can't compensate for every vulnerability in the software underneath your application, which is why we need to be able to be agile and release updates quickly and safely. Please patch your PHP. One more thing that I needed to mention that I didn't mention in that video. If you are on WordPress.com, so if your website is hosted by WordPress.com, you are safe from this vulnerability. However, if you are hosting WordPress yourself, if you're hosted elsewhere, if you have taken your version of WordPress from WordPress.org, none of that is the same thing. None of that is guaranteed. And I need you to go check right now. So again, good job, WordPress.com. Thank you so much for having the announcement and patching that quickly. I appreciate you.
