PHP Zero-Day Leak: Back Up Your Website Before the Patch

0:00 The internet is screwed guys. We are living in a world of AI and that is supposed to help and improve our daily lives, help us code better websites and be more productive in general. But it's also finding all of these vulnerabilities in our everyday software that we're using. And in this case, PHP, which powers huge amounts of the internet, has been compromised. Well, Actually, it's been compromised since version 5 was released, which was released back in 2004, and all the versions from then to now have this particular vulnerability where someone can get into your PHP-powered website and upload anything they want. Now, to show you how big this impact is, PHP runs pretty much over 50% of the internet, at least. Any website that you jump

0:54 on out there is probably running some version of PHP or on the servers or wherever it is. If you've heard of a content management system such as WordPress, Joomla, Drupal, Magento, they all run on PHP. This vulnerability is absolutely insane. So PHP is my daily bread. What I use to power all these websites. Now I don't do much PHP coding these days, but all the software that I use runs on PHP. So these vulnerabilities here, these are the CVE codes that we're looking at at the moment, but we're seeing people actually be able to replicate the vulnerability and show you exactly how it all works too. So if you want to check out the details, I'll put links to this here, but you can see how it actually works and get into the details of it. But

1:47 for the majority of the people out there, you don't need to know that. What you need to know is what do you do next? Or what if you are running a WordPress website? What if you do have a Joomla, Drupal or whatever website out there, what do you do? And there are some really good guides in regards to what to do next that have come up, which is fantastic.

2:08 This one here is by The Huntress. The majority of the people out there, if you're just a small website operator running on a hosting environment, such as SiteGround, WP Engine, or even through Automattic's own hosting environments through WordPress Run, you don't need to do too much other than take a backup of your website just in case anything happens.

2:31 And just prepare yourself for the worst case scenario. Because this could be very prolific in regards to the amount of damage that could happen if the environments aren't updated in a timely manner. Now, according to this, it is 4 p.m. here in Australia. And there should be a release date. update of the patch available for me by 1 a.m. tonight. So 1 a.m. Thursday, roughly nine hours, maybe even earlier if we're lucky. But if that is released, my hosting environment should automatically update that all for me.

3:06 So I should be okay, but I still need to watch and see what's happening. So all my clients are running PHP based websites. I've manually taken backups. I've taken every security precaution that I can. made sure all the firewalls are in place, and I'm just monitoring activity at the moment on the servers to make sure nothing malicious is happening. But here, if you are managing your own environments, have a look and work out where every PHP version is installed on your environment so you know where things are in case you have a rogue version of PHP installed ages ago and you haven't been looking at it, it could get compromised. So do check all your versions that you have so you can patch them or remove them,

3:44 remove the old ones. So plan your patch window. Wednesday, October 21st, 10 a.m. Eastern Time. So that's when it's supposed to come out. You can check out the official PHP announcements website here. This is an announcement about this critical vulnerability, but make sure you're keeping an eye on the php.net archive website so you can see when the new release is actually coming out. The next thing here, identify any end-of-life PHP environments that you may have. So PHP 5, 7, 8.0, 8.1. are all end of life, so they may not even get an update. So if you're running on an old version of PHP for whatever reason, get yourself off that now so that you can get a patch for the latest version. The version 8.2 is

4:30 reaching end of life at the end of this year in December. So technically, if you're on 8.2, you should probably try and move off anyway. So we did an audit of all of our websites really quickly using AI as well. and made sure that all of our websites work on the latest versions of PHP 0.4 and 8.5, whatever the latest patches are. So we're all good in that regard. We're just waiting for the latest patch to fix and stop this zero-day vulnerability that allows for remote code execution. It's rather scary to see that. Anyway, the huntress here, keep an eye on what PHP spawns. So you may see hackers start to execute packages uploaded files that they're uploading to your server environment. And if you

5:16 see that, probably see the activity increase and server load increase as well. So if you see a spike in memory usage and CPU usage, it's highly likely that your environments are being used for sending out spam or something malicious. A lot of the times they're really smart. hackers out there would just implant something and just leave it there dormant and leave it there for several months so that they could come back at a later time when you're not watching. So the smart hackers would do something like that.

5:45 The ones that are trying to just be opportunistic in this type of scenario would probably just send out spam and start using your server resources for something like that. Now, the last point here, they said, if you find something, isolate the server, preserve the web server and PHP logs, look for web shells and new files in your web route along with new cron jobs, scheduled tasks and accounts.

6:07 So that's locking down and working out what's actually happening in your environment. So this is what is going on guys. It's crazy that we're seeing this type of vulnerabilities and such a widespread one within the PHP space within the internet. It's absolutely insane. So if you are affected by this, Just take steps, precautions to protect yourself just in case something does happen to your website. For a lot of small businesses out there, this is probably your livelihood. This is the front door to your business, to your customers.

6:40 And the last thing you want is your website to be compromised and in such a malicious way as well, just essentially giving them access to your entire server and letting them download all your customer data, install malicious code on your website. and hack your details and everything else around it. So please take back up your website, talk to your service provider, talk to your hosting provider, make sure everything is backed up and as secure as possible. Firewalls, everything else put in place as well. All right, guys, I'll keep you up to date with what's happening with this one here. Try and stay positive. The internet is a scary space with all of these potential vulnerabilities, thanks to AI, but we also have AI to help us

7:21 patch everything up as well. All right, guys, Stay positive and I'll see you in the next video.