What happened

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the two PHP2Shell vulnerabilities in the PHP programming language to its catalogue of known exploited vulnerabilities. Researchers at Dream found attackers chaining PHP2Shell with a flaw in Palo Alto Networks firewalls to break into networks, with at least 25 servers compromised, including one linked to the US government.

The exploitation capped a difficult month that some in the industry have dubbed "Black October".

Why it matters

PHP runs a huge share of the web, including many apps hosted on AWS. When a widely used language has an actively exploited flaw, every unpatched server becomes a target, and attackers move fast.

How to protect your AWS environment

• Patch PHP on every EC2 instance, container image and Lambda layer now.
• Use AWS Systems Manager Patch Manager or Amazon Inspector to find unpatched workloads quickly.
• Put a web application firewall, such as AWS WAF, in front of public PHP applications.

Source: Click to Read the original report (The Record)