SANS ISC lowers Infocon after PHP patch push, warns public exploit likely
The Internet Storm Center returned to Infocon Green after raising its alert level for a PHP vulnerability, saying patches are out but working exploit code may follow.
The SANS Internet Storm Center returned to Infocon Green after raising its alert level for a PHP vulnerability, writing in a wrap-up that the coordinated disclosure had largely worked: many vendors released patches in sync with PHP.net, giving defenders tested fixes in a timely manner. The center called early detail leaks by some vendors unfortunate but not enough to overshadow that outcome.
As of the post, no reliable public exploit was known to the author, Johannes B. Ullrich. Several firms said they held working exploit code, and he expected it to surface eventually, with wider exploitation to follow. Cloudflare and Amazon reported large numbers of exploit attempts, though it was unclear whether those were working exploits.
His advice: patching remains the best and only reliable defense, and organizations that cannot upgrade should isolate vulnerable applications. Workarounds and web application firewall rules may buy time but are not considered fully effective. Embedded devices and appliances, many of which will never be patched, should be isolated regardless.
He also cautioned that released partial exploits may be "parasitic," targeting whoever runs them.
Sources
- PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)Primaryisc.sans.edu
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning