PHP2Shell Vulnerabilities Put 70% of Websites at Risk

[raykloss (Ray)]

I had one web site on Wordpress that I set up long ago for free. Logged in to check it and I have to go through a vetting process (from what it sounded like). Do they still have basic free pages or is that a thing of the past?

[josehill]

@raykloss

Do they still have basic free pages or is that a thing of the past?

WordPress.com still offers free websites, though I haven’t looked at the specifics in a long time. They do report that their hosted WordPress services have been patched.

Your WordPress.com Site Is Protected Against PHP2Shell Vulnerabilities

[david_blanchard]

@TBTdn

@david_blanchard

I modified the .htaccess file to disallow all until this was fixed.

is potentially very useful, sort of an ‘on/off switch’ for a site. With it on, I take it a 404 error page or similar would appear…

I had asked duck.ai how to do this. It gave several methods but the .htaccess was the best choice. An edited version of the answer below:

If you want to completely block all public traffic to the site without deleting any files, you can add a rule to your .htaccess file in the site’s root directory.

• How to do it: Add the following lines to the top of your .htaccess file:
  Order deny,allow
Deny from all
Allow from [Your IP Address]
• Benefit: This locks everyone out except for you, ensuring no one sees a broken site while you work on the PHP update.

…and it worked just the way I wanted. The actual error code – if I remember correctly – was access denied.

[josehill]

@david_blanchard

It gave several methods but the .htaccess was the best choice

Note that the .htaccess method is intended primarily for Apache-based web servers and generally will not work with other web server software.

If your web host uses different web server software (“nginx” is very common), you’ll need to find out how to configure it accordingly. The specifics on that will depend on the server software.

[tidbits-ns (Scribblings)]

As a Dreamhost customer I was happy with their response. Yes they didn’t e-mail everyone, instead they did two things: 1. Put in a WAF (Web Application Firewall) rule so any attempted exploit didn’t get to your server and 2. Upgraded all the versions of PHP. I have their status feed come to slack so I knew what they were without needing an e-mail. They should have e-mailed, but happy they put their limited resources where they did.

Also very happy with Cloudflare’s response, which was to put a WAF rule in before the announcement (they were given a heads up under embargo). If you don’t have Cloudflare’s free plan in front of your web sites, maybe you should (you should).

NB: to the best of my knowledge (and I do web security for a living and as CSO am responsible for whether our business and services we provide to customers gets hacked) there has been no actual real PoC (Proof of Concept) break in. Millions of attempts, all thwarted because they didn’t work and lots of claims that some AI Slop piece of code does it, but as yet, none.

if you haven’t patched a server you maintain, stop reading and go do that. We end up patching our servers most days for some potential security issue, this is only getting worse.