Abstract:
The PHP Foundation released a new version at 10 o'clock last night to fix the PHP2Shell vulnerability. The network service provider Cloudflare had been informed of the vulnerability in advance and deployed mitigation measures through WAF rules. Subsequently, Cloudflare began to observe a rapid increase in attack attempts. Currently, the number of observed attack attempts has exceeded one million.
Cloudflare deploys WAF protection rules in advance:
Cloudflare began preparing the rules in early October and completed deployment approximately 9 hours before the vulnerability was made public, and starting at 03:02 UTC on October 21, all free and paid sites with Cloudflare WAF enabled received protection by default.
This protection uses Cloudflare's new complete transaction detection, which combines analysis of HTTP requests and server responses to determine whether the request exhibits exploitation characteristics and whether the server returns abnormal results. After a rule is matched the WAF can intercept the response before it reaches the originator of the request. This mechanism can reduce false positives caused by judging the request characteristics alone, but it cannot undo operations that the server has performed before the response is generated.
Cloudflare has blocked over a million attacks:
Cloudflare CEO Matthew Prince tweeted that in the 10 hours before the PHP vulnerability was publicly disclosed, thousands of attacks had appeared on the network, and these attacks were attempted using different combinations of variants; these attack attempts reached tens of thousands 45 minutes after the vulnerability was disclosed, hundreds of thousands within 2 hours, and millions of attack attempts since then.
However, this is only Cloudflare's observation data. The number of network-wide attack attempts may be much higher than one million levels. And it is hard to say that hackers have succeeded by this time, and some sites using old versions of PHP have been hacked.
WAF can only alleviate the problem and will eventually need to be upgraded:
It is important to note that even if you use Cloudflare WAF, you must upgrade PHP. Protection rules can block some attack attempts, but hackers are also trying a large number of variant combinations, so websites that use PHP still need to upgrade the PHP version. Upgrading to an unaffected version can improve security, and you cannot rely solely on WAF rules.
Related articles:
Cloudflare deploys PHP vulnerability protection rules in advance, but websites must still install official patches as soon as possible
Comments