Security Advisory: PHP2Shell Critical Vulnerabilities
We want to make you aware of PHP2Shell, a newly disclosed set of critical vulnerabilities in PHP that can allow unauthenticated remote code execution on affected web systems. Security updates have been released to address the vulnerabilities for supported PHP versions.
In plain terms, PHP is software that runs many websites and online portals, and these flaws could let an attacker take control of an affected site or service without needing a password. The flaws can also expose passwords and other sensitive information handled by an affected site.
HalcyonFT’s client environments are primarily SaaS-based, and the Saas providers are responsible for patching public-facing PHP infrastructure on your behalf. We are reviewing the vendors and services that HalcyonFT directly supports or manages to determine whether any follow-up is warranted.
For established SaaS providers, vulnerability identification and remediation falls within the provider’s vulnerability-management program. Where HalcyonFT has previously reviewed a provider’s security controls, those controls generally include processes intended to identify and remediate critical vulnerabilities such as this.
You may choose to seek direct confirmation from particularly critical service providers that they have evaluated PHP2Shell and taken appropriate remediation measures. HalcyonFT can assist in evaluating vendor responses.
If your firm has its own public website, we recommend confirming with your web developer or hosting provider, that the PHP security updates have been applied. We can help with that conversation as well.
This situation is still developing, and we will continue to monitor it. Please contact your HalcyonFT team with any questions
Best regards,
— Your HalcyonFT Team
Best regards,
— Your HalcyonFT Team
{ HALCYONFT UPDATES }
More Insights
{ CONTACT }
