PHP2Shell: The Crack in the Internet’s Foundation

Josh Lupresto (00:00)
Last week, hospitals pulled their own websites offline. Hospitals. A national cyber agency told the unpatched sites to just shut down. A government in Europe got its multi-factor secrets and password hashes stolen. And 22 million servers around the world last week got flagged as sitting ducks. But what’s the cause, if you haven’t heard? Two flaws buried in PHP.

That’s the programming language that runs about 70% of the websites on Earth, just kind of quietly behind the scenes. The industry named this one, if you haven’t heard about it yet, called PHP to Shell. This is a nod to an old breach called Log4Shell. both of those flaws rated a 9.2 out of 10. And that’s bad. 10 is the absolute worst, scariest breach that that that can be rated. But here’s the part.

I think this makes every customer sit up, makes you sit up. this this hit a lot of people. This is a hole that has been sitting there wide open for over 20 years. Nobody found it until AI did in about a week. And that is the story I want to tell you about today because this isn’t really an episode about PHP bug. this is an episode about just this a brand new dynamic that’s changed the rules for every business.

That runs software, which is all of them. Last I checked. And I think it hands you a you know, probably the single best reason that you’ve had in years to go pick up the phone. So let’s jump into it.

Welcome back to Next Level BizTech. I am Josh Lupresto, SVP of Sales Engineering, and today’s episode is called PHP to Shell, The Crack in the Internet’s Foundation. And I think this is going to drive you to make some calls here coming up soon. So this one is a security story, but stay with me because I think the lesson here underneath this is going to reshape a little bit about how your customers think about risk.

And doing the CISSP big c security certification, that was one of my favorite things that it taught me back in the day was how to help customers look at risk a little bit differently. And I think that’s the pure opportunity right here. So let’s nerd out for a second, get your propeller hats on here. if I didn’t have these headphones on, I’d I’d put one on for you right now. Let’s start with what PHP even is, because you’ll want to explain this simply, right? Or you wanna understand this if you don’t have the foundation of this already. So PHP is just a programming language, right?

Think of it as th think of it as the cook in the back of the restaurant, okay? you never see the cook, but every single plate that comes out of that kitchen got made back there based on you know what your order was, right? PHP is that cook, I think, for most of the internet. So think about platforms like WordPress, you may have heard of Drupal, Mag Magento, tons of different

Business apps, look, this matters. Look, a lot of phone systems that are out there, a little bit more public phone systems and firewalls. Some of these guys all have PHP running quietly inside of them. Okay. This PHP to shell, it left that back door to the kitchen unlocked. So two vulnerabilities sitting in PHP itself is what the cause of this was. So they had everything built on top of it. And

Because it’s in the foundation, it it it didn’t really matter how good your website was or how careful the developer was. The crack was underneath all of it, right? Something that nobody expected. Now, here’s how this week, this past week actually played out. It’s pretty ugly. So the details got leaked early, defenders got less than twenty four hours of real warning, and the attackers got the exact same head start. That sucks.

So within hours of the patch, working attacks were already circulating. Amazon, Amazon Web Services has a pile of honeypots, right? Which is they put out to make it look like you know, easily attackable servers, but it’s really to collect the information on what bad guys are doing, seeing how they’re gonna get in and learn from that. So Amazon’s honeypots actually caught explo exploitation attempts four days before the public even knew. And just in the last few days,

we’ve seen the first confirmed in the wild attacks and attackers stealing credentials you know, out of out of European government agencies and things like that. So there’s there was a lot, a lot of breaches. So let that sink in for just a second. The people’s job or who the people whose job it was to protect these systems got a few hours notice. I I I watched one post that said from a a C CO he’d been up for 48 hours straight and he was ready to go to sleep.

So these attackers were already inside that window though, in at least one case, right? Ahead of it somehow. So that’s a complete inversion as to how this is supposed to work. And I think the scale of this exposure is pretty staggering because this code goes back to 2004. PHP is old. when I started started doing Linux and Apache and things like that, when I started learning first how to do all of that, there’s a thing called a lamp stack. It had Linux, it had Apache for the web server, and it had PHP.

And that was how you could design very simple websites and databases, right? So this that’s when when all of this started coming out. So so PHP website, any of those built in the last decade or two carried this. Whether anyone knew it or not. patching closes the door today, thankfully, but it doesn’t tell you whether somebody walked through it last week, last year, five years ago. look, these guys are patient. The only way to know that, I think, is to go look.

All right, let’s get into the second part of this here. The the the real story. AI changed who finds the cracks and how. So let me let me explain this a little bit. So a serious bug got found and it got patched. That happens. Why am I telling you that this is a turning point this time? I think it’s because of how it was found. this is the part that really matters, okay?

The vulnerability was more than 20 years old. Talk about being patient and playing the long game. human researchers, right? Good ones, world-class teams have been looking at PHP for the better part of 20 years and never caught it. Okay. Then researchers pointed frontier models, so think anthropics and open AI is really, really powerful frontier models. They pointed it at them. And one of them found it in about a week. Crazy. So one security firm was quoted to say,

That a single researcher working with AI did it in a week, basically what used to take a world-class team months. So these AI agents were building working attacks while the researchers were just, you know, sleeping. That’s the crazy part. So so here’s here’s the shift. back to the earlier point. Here’s the shift, and I think why it’s why it’s pretty monstrous. So AI just compressed vulnerability hunting from months into days.

These bugs were always there, not a huge deal, right? But AI made them practical to find, practical to weaponize, and also at a speed that we have never seen before.

Now I want to go a little bit deeper. the propeller hat is up there. It’s it’s it’s spinning, but I wanna go a little bit deeper because there’s a second shift underneath that one. And I I I think the part of this that’s real it’s the wake-up call for your customers, okay? PHP2 shell wasn’t one clean bug. When the researchers took it apart, it was actually three separate flaws that had to be chained together for you to be able to break in. That’s crazy, right?

On their own, each of these was the kind of thing that a security might look at and shrug off, right? A little memory hiccup or just you know some leftover data here, a much, much lower than a nine, right? One, two, or three, something like that. So individually, not a breach. Harmless, honestly. But chained together in exactly that right order gets you a nine point two out of ten. So what what does the nine point two mean? Well, that means if I’m a bad guy.

and if I can chain those three things together, I have full remote control of whatever it is on the other side of that server. And that is the new dynamic that I want every advisor here, every one of you, to understand. The old world was about this kind of serial process of finding the one big obvious hole. Okay. And we still have to do those, but now it’s a little bit different. We gotta think a little bit different. This new world, the AI world, is about.

Discovering which combination of small, boring, individual, you know, ignored weaknesses can be linked into just you know, the next catastrophe. Okay. A human, you could you could almost guarantee a human might have never connected these dots, right? AI will try just millions and millions of combinations overnight while everybody’s sleeping to try and find one that that works. Think about think about what that does.

To the phrase that every customer loves to say, we’re fine, our systems are hardened, there’s nothing to worry about here. Move on, right? Let’s talk about something else. that statement was based on the old model, right? Defend against the obvious holes. And I’ve been in plenty of those conversations where we have seen that legitimately, and there isn’t anything that we can sell those end customers. but this just changes everything. New fear unlocked, okay.

It’s i this whole theory and this this way of chasing it is now dangerously kind of out of date. So your customer systems, yes, they can be patched individually, right? This is how we do patching. they can be individually hardened, but you could still have a chainable path through them that nobody, no human ever thought to look for. Because until now, nobody could look for it at that scale. That’s the thing.

So the honest message to put a bow on this is it it’s this. Hardened does not mean what it meant two years ago. The attackers have now found a tool that just finds the combinations that your customer’s team never had the time or the manpower to go hunting for. That is not fear mongering. I don’t like that. that’s just the new math. And that is, I think it’s the single best reason to go have a conversation.

everything that we think about here and every conversation that we have with our suppliers as we learn their technology, I’m always thinking and I always want everybody on our team to be thinking, how can we turn this into a conversation that a TA can go have with an existing customer, an uplift, a cross sell, a cross sell, a new customer? And that’s I think exactly what this is.

Let’s go to part three here. Why is this you? Why is this you, the advisor’s conversation to win? So let’s connect this. let’s connect this straight to you because I think it’s it’s it’s one of the cleanest opportunities that I’ve seen in a long time, right? we’ve talked about a lot of AI things lately on this. So this is this is very direct. So here’s why it’s good. This is a story that your customers already heard, right? It was in the mainstream news.

Hospitals offline, governments losing, you know, MFA, people scrambling, just take it offline. We can’t figure it out. We don’t know what’s happening. This isn’t some obvious CVE that they’re very familiar with, common vulnerability and exploit. only the security nerds care about, right? Your customer saw a headline about it. So you’re not walking in cold trying to manufacture this concern. You’re walking in with curiosity about just something that they’ve already, you know, maybe a little uneasy about.

I think that’s the easiest door to walk through. There is, right? There’s gotta be, we know we know the deal, right? Bant qualified leads. You know, it’s gotta be some budget, gotta be some need, gotta be some timeline, all those things. and I I think that the the beauty in this is that it’s not it’s not buy something, right? That’s not your opening. It’s let’s make sure that you actually know where you stand. Three simple things that I think every business should be able to answer after a crazy week like this.

What do you run? Who owns the fix? And who do you call? Full stop. So i if you look at that, you know, you look at how this situation affects it, I most customers cannot confidently answer all three of those. Some can, but I would say most cannot. Helping them get there, I think, is it’s pure value, right? And it’s the start of a relationship. This is not a pitch. Okay. you guys know this. I sold vacuums door to door. That’s a pitch, right? We we’re

I might have thought we were starting a relationship, but I was doing a pitch. So here’s where I think it blossoms, just to continue this thought, I think it blossoms into real opportunity because this one story opens some doors across your entire portfolio. Okay. So let me let me let me explain. Let me let me walk through the map a little bit with you.

So it’s a security conversation, obviously, right? We’re diving deep into that. You know, it’s got vulnerability assessments, it’s got patching discipline, it’s got detection that doesn’t wait for a signature. It’s got the whole modern security posture. But watch how it branches out a little bit. It’s an infrastructure modernization conversation. That’s a lot of big words. here is a detail I think that most people missed. The official patch.

Only covers the newer PHP versions. But roughly half of all PHP sites are running end-of-life versions because you just put it on and it just works, right? Those literally cannot take the patch without upgrading the server or modernizing the old code. Sometimes you call application refactoring. So are you even able to patch this? Because

let’s talk about modernizing that legacy system that you’ve been putting off. I think that’s a real that’s a real infrastructure project. Also, though, started doing some of this lately. We’ve got some great suppliers that do this. It’s a code review conversation. And I I I love code review from that perspective, given this whole new chaining angle thing. So if the new threat is AI finding combinations that nobody stress tested, then

When did anyone last actually review this application end to end, not just patch it, you know, piecemeal? Doing that becomes just a genuinely important question. So think about things like custom apps, old integrations, that stuff that’s just been running untouched for years, because what they’ve always what I said earlier, it it it just works.

That’s exactly where those chainable gaps hide. Like it’s breeding ground for that. And it look, it’s it’s you know, it’s even a UCAS, it’s a it’s a life cycle conversation. If some of these guys are running some open open source, you know, homegrown UCAS, some Asterisk, some free switch, all those things. PHP is the lifeblood of some of those, right? It hides in some in inside some of those phone systems, some of those appliances, you know, who knows?

they may have that exposure and then they can’t even fix it. So those people that have been like, I’m just gonna stay on this box because I’ve had it for a while and it just kind of works. I don’t know that I want to go to a you know full UC platform yet. So if your phone system is patched, does your vendor even still support it? I I look, I think that opens up a refresh conversation and a UCAS conversation on top of security.

One news story. And I think it legitimately branches into security, infrastructure modernization, code review, and and even voice, like we just talked about. It’s not coincidence. It’s because this PHP two shell cracked the foundation, like we talked about in the beginning. And everything your customer runs sits on that foundation. You, talking to you.

or the one that can walk them through all of it.

let’s go let’s go part four, because you know we’re not going to leave you here without some questions to ask. My favorite thing on the planet is arming you with questions. So let’s make these usable here. And and the tone here matters, okay? Lead with curiosity. Say that again. Lead with curiosity, not alarm. Okay. You’re this question.

Home guy, you’re not the person setting their hair on fire. These people already don’t sleep at night, right? Write these, write these questions down. So start soft. and and on on the open here, let’s say, look, hey, there was a lot of noise last week about a big PHP security issue. how did your team come through that? Just stop. Take them to lunch, ask that conversation. That’s it. That is the opener. It’s a low pressure,

Easy, timely, and and look, their answer is gonna tell you everything about how buttoned up they are. A confident answer is great. a vague one is one that opens just it opens that door wide open, honestly. All right, so you do that one. let’s go maybe to let’s let’s let’s hit on visibility a little bit. Here’s one. ask this one do you actually know everywhere PHP is running in your environment?

Including, you know, inside things like maybe you got an old legacy phone system, old homegrown firewall, things like that. Almost nobody can answer that. you think about things like PF Sense and some of these other open source firewalls people run on their own hardware. Nobody can answer that because it’s buried in those appliances. I think that gap is real. and it’s it’s it’s yours to help close it. Okay, let’s talk about let’s go to ownership a little bit.

let’s ask this one. So for those systems that are exposed, is it clear who is responsible for the fix? Is that your team? Is that a vendor? And who’s gotta ship it? I think what that does is that splits the problem a little bit into what they control and what they’re waiting on the vendor for. And then the vendor dependent stuff obviously opens a, you know, straight into some lifecycle refresh, things like that.

Then the modernization. I love this type of question. Some of the best deals I’ve ever seen have been around modernization. So ask this one. Do you know if any of your systems are running on software so old it can’t even take the latest security patches? Half of the, we talked about this, over half of the PHP sites out there are. So it’s not just like, great. Okay, new scary breach, they strung it together, we got a patch.

Half of the stuff can’t even be patched. That’s what’s crazy, right? Is as quick as this news came, I don’t know that that part made it through the news very well. So look, this is this is legacy modernization. This is the opening for that, right? It’s delivered as a simple yes or no. you know, they they probably can’t answer it. That’s a tough one.

And then I’d say land it on this, right? land on kind of this big shift. Ask ask them this one.

Here’s the thing that changed. AI just found a twenty year old hole in a week. If the attackers can now find weakness that fast, how comfortable are you that the once a month patch cycle is keeping up?

I think that’ll reframe everything. You know, it it it moves this conversation from this one bug to a whole new speed of of threats. And I think that’s the conversation that leads to some real work. Okay, again, like we always put a bow on this, think about the arc there. You’re not doing fear, you’re not selling a product, you’re just helping them see that the ground shifted.

And you’re helping them figure out where they actually stand on that ground. And when they say, okay, you know, can you help us? Can you look? Look, that’s you know, shameless plug here from a sales engineering perspective. Don’t go it alone. You’ve got that relationship. you’ve uncovered that opening, you’ve gotten through, you’ve not led with fear, you you’ve got the depth, right? You’re not expected to know all the nerd propeller hat stuff about this PHP two shell thing.

you know, you’re not out we don’t we don’t think you’re out there doing Nessis and vulnerability scans and auditing code and things like that. you’ve got a team here to help support that. Think about the three four hundred plus certifications, the multiple CIS SPs that the Teleris team has, right? you’ve got a lot of even deeper security certifications, additional certifications than that. that’s

patching, the detection, the assessments, the strategy, we will help you uncover that, right? That’s really where the suppliers I think come in great. and that’s what we’re here to help you for. So when the customer says, Hey, help us figure out what we’re exposed to and what to do about it, and you get those pauses, that’s the cue to bring us in, right? We’ll go as deep as it as it takes, you know, going across that solution map and just hopefully turn this scary headline for a lot of these guys into some concrete plan.

let’s see. So look, I if you add if you add all of this together, you’re not just reacting to this PHP to shell thing, right? You’re using it to make your customer more genuinely secure and you become that person that they call next time the ground shifts because it is going to. We’re we we had something else planned on being released for today, but specifically because of this PHP.

We wanted to get this out in front of you sooner than later because the ground is just shifting. That is what it is. And it’s gonna keep happening. Okay, so let’s get some some final thoughts here. So let’s let’s look ahead a little bit. This PHP to shelfing was not a breach at one company, it was a crack in the foundation, in most of what the internet is built on. Sitting there for how long did we say? Over 20 years, invisible.

until some AI platform found it in a week. And that’s the and the deeper lesson is like it’s it isn’t about PHP. It’s just that the game changed, the ground shifted, and these attackers now have a tool that finds the weaknesses, finds these different combinations of weaknesses, and honestly finds it faster than any defender ever could by hand. So today it’s they strung, you know, just a couple of these exploits together.

People are gonna get ahead of that, they’re gonna harden that, they’re gonna fix some code on that, and then some more modern AI is gonna come out and it’s gonna say, my gosh, we strung seven exploits together, right? Maybe that’s the next breaking news thing we’re gonna talk about. So if before the customer was saying, we’re hardened, you know, we’re fine, like that’s not a safe assumption anymore. It’s honestly, it’s a question that deserves a real answer. And I think that is exactly why this is your moment to shine here, right?

It’s not to spread fear. Again, like we talked about, come in calm and curious. It’s just to bring some clarity to the situation. at a world where it just seems like the cracks are getting found faster than ever, right? The customer needs help and needs someone like you to just help them know, right? Look, they’ve they’ve gotta run it, they gotta know who owns the fix, they gotta know who to call, right? Again, that is you, the trusted advisor.

so if we look ahead a little bit further, I think you you expect more of these. could have some more breaking news things. and these could come out faster, right? Who knows? Just it’s it’s every every couple weeks something wild comes out. So the experts are are are pretty clear on this though. The AI assisted discovery is definitely here for both sides, right? Good and for bad. and I think that gap between the flaw being disclosed.

And you know, being attacked is collapsing towards zero. This monthly batch cycle thing, right? if some people aren’t even on that, that’s just on borrowed time. So let’s help our customers get ahead of that curve now. So this week, go pick one customer, make the easy call. How did your team come through the PHP thing? And just listen. Wherever they get vague, that’s your next project.

That’s it. that wraps up the show for today. Hey, do me a favor. wherever you’re listening to this, go follow, go subscribe, Spotify, Apple Music. You get these every Wednesday. We’re trying to bring you some questions and some things to help get those conversations. So until next time, I’m your host, Josh Lupresto.