When The Fix Isn't Upstream

You may be familiar with the php2shell vulnerability that was recently announced to the world. When I learned of its existence, I sprung into action to correct it. The problem wasn't that a fix wasn't available; the fix existed, but the deployable image didn't. Most of my php instances were inside Docker containers, and the maintainers hadn't published fixed images. Upstream was out of date, and we had a critical vulnerability facing the internet, just waiting to be exploited.

Taking a site offline isn't ideal, even if it is a self-hosted service with minimal users. Popular sites were being brought down to patch this vulnerability, so you know it was a big deal. I blocked access to my vulnerable php instances, but I had a decision to make- either wait for upstream to patch the images, or to manually patch the images myself.

Being completely honest, if I had to do all of it myself, I'd have simply waited. However, I had an AI Agent at my disposal. I decided to take a crack at instructing the AI to patch these vulnerable php instances. It was the fastest way for me to both reduce downtime while patching the vulnerability. While a little messy, it seemed like the best option, and I wanted to act fast.

When I first learned about php2shell, I used the AI agent to find all of my vulnerable PHP instances, but an issue was quickly discovered. Many of the images were not updated with fixed php. The fixed release wasn’t something I could simply pull and deploy. That's a big deal, but if the AI can build the images manually, perhaps we are in the clear. It would take some doing, but I wanted to see if it was possible for the AI to implement fixed versions of php on all the impacted containers.

Thankfully the AI made this possible. We walked through each container, looked at the specifics required in order to update php, and executed. While some of the containers were more difficult than others to update, it went better than expected. Without the AI, I'd have been left waiting for upstream maintainers to publish the fix. With AI, I was able to come back online quicker than most. It was an impressive display, although only highlighted the need for me to reduce my attack surface- see my previous post for more details.

The impact of php2shell is significant. A huge portion of the internet uses platforms which employ php. Wordpress, the popular open source CMS solution, uses php under the hood. I can't imagine the amount of vulnerable instances which are still vulnerable, and while I'm sure many maintainers of popular docker projects rushed to patch their images, there may be a time when you need to take matters into your own hands. Otherwise, the only choice you have is to pull the plug and wait for maintainers to patch their images, and you may not be able to afford it.