(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
Excerpt from the primary source: SANS Internet Storm Center
Who is affected
Security professionals
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Security research
Related
Abandoned Popcorn Time app exposed millions of device to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
Apply the vendor's security update for the affected products.