TSB intermediate e: PHP2Shell

Hello gang, welcome to the security box, program 280 Intermediate E.

On this program, we’re covering something called PHP2Shell two vulnerabilities that were disclosed the same day.

Not only that, we have a third vuln which is mentioned, as part of something we played last week but part of the article I read.

I discuss the difference between RCE (vulnerability exploition) RCE (code you run yourself) and we make sure that we tell you that we do not know whether any of these have been exploited and taken care of.

This is the link to the PHP2Shell article titled PHP2Shell and the Internet’s Very Bad Day: What Happened, What’s Vulnerable, and What We Can Learn.

Here is the Trend Micro Video if you want to listen and or watch it on your own.

We’ll be back with a full TSB episode unless something breaks.

As a side note to these notes, other podcasts including Security Now! have also covered this. SN covered this in podcast 1102 of their series explicitly.

We also have coverage from podcast 280F from articles around the landscape which will be posted later on.

The JRN will be looking at continuing to see what’s happening in this space.