How to Protect Your Radio Station From PHP2Shell

Also see this related coverage about which equipment manufacturers are moving to patch equipment in light of the PHP2Shell vulnerability. 

If you handle network security duties for your radio station or work with someone in IT, you know this past week was bumpy.

After news of a critical PHP security flaw started to trickle out Wednesday, administrators began pulling affected websites and web infrastructure offline to protect their networks. An estimated 70% of all websites run on some form of the PHP programming language.

Software engineer Jeff Geerling knows open-source software such as PHP better than just about anyone. Radio World asked him to put the flaw, PHP2Shell, in perspective.

“More than half the internet, at least in terms of public services, runs on PHP,” Geerling told Radio World. “And millions of routers, device backends and embedded tools also use PHP, though many of those are protected by not exposing that interface over the public internet.”

This was a big deal. And speaking at its AI Tour event in Germany, Microsoft CEO Satya Nadella said of the PHP vulnerability: “I’ve not seen anything like this in a long, long time.”

Making matters worse, it was not the only security headache triggered this week.

An eMudhra intermediate certificate compromise could allow attackers to forge certificates and bypass web encryption, particularly on devices that are updated infrequently.

“This vulnerability was so bad, and the reason for its existence so embarrassing, the company involved already abandoned that part of their business,” Geerling said.

Meanwhile, Node.js, the widely used JavaScript application runtime, patched 10 separate security issues this week and urged administrators to update immediately.

The aftermath leaves a whole lot of cleanup.

“The next few weeks and months will be stressful as everyone tries to update firmware and backend systems on networks that remain wide open if someone breaches the LAN (local area network),” Geerling predicted.

Not just a dinosaur

If you worked with websites even in the 1990s, you probably remember PHP. It’s still around.

Many in software development would consider it a “dinosaur language,” but it remains prominent as a server-side scripting tool. PHP is found in WordPress and that content management system is relied on by an estimated 40% of websites.

The core issue that was revealed publicly this past week centers on what’s known as an out-of-memory buffer corruption. If triggered at the right moment, an unauthorized user can execute code with application-level privileges, leaving the target machine, typically a web server, compromised.

According to reporting from CNN, this particular PHP vulnerability was uncovered in 2004 when security researcher Stefan Esser sent a warning about the flaw. It went ignored, according to CNN, because of just how arduous it would have been for humans to formulate a patch.

But that’s where AI enters the story.

And teams at OpenAI and two cybersecurity firms uncovered the vulnerabilities over the summer using AI-based discovery tools. The PHP Foundation, which maintains the open-source language, had been actively coordinating a security patch. According to the foundation’s blog, however, technical details leaked on social media on Tuesday, forcing the project to issue an early warning.

Because a software distributor published elements of the patch before the coordinated release, potential attackers could access the fix while users were still waiting for updates.

“This disregarded weeks of work by many parties toward a coordinated disclosure,” the PHP foundation wrote.

As a result, a few companies noticed attempts against their infrastructure before the public release, Geerling told us. Modern AI-assisted tools — the other side of AI in this story — were likely able to find ways to exploit the flaw just based on rumors and bug reports, Geerling suggested.

No successful intrusions from the flaw have been confirmed, according to TechBrew, but exploit attempts jumped from thousands prior to the disclosure to millions by Wednesday night, according to data from Cloudflare.

Can our defenses keep up?

What could be running in your station’s plant that incorporates PHP?

Virtually any device featuring a browser-based management portal, including audio processors, codecs and transmitters, relies on an internal web server. As a result, PHP code may sit inside that hardware.

And here’s Geerling’s primary takeaway for technology managers: Be vigilant.

“Make sure any device you run is at minimum protected by your corporate firewall,” Geerling said. “No internal devices, especially critical airchain equipment, should be accessible on the public internet.”

Geerling advises engineers to subscribe to vendor security mailing lists and software update feeds. Where automated notifications are unavailable, stations should maintain an inventory checklist of any equipment running a web interface or remote-access portal, routinely checking manufacturer websites for firmware updates.

As we are reporting separately, manufacturers are moving to patch their products as the vulnerability is actively targeted.

But a public-facing platform is even more of a target. That could mean your station’s own website, or it could be an online scheduling tool your station developed on its own that your staff uses.

If those tools rely on any form of PHP, it’s time to take them offline for some emergency maintenance if you haven’t already. The PHP Foundation released patches for multiple PHP versions you can install here.

AI helped uncover this security flaw, but as Geerling pointed out, the widespread availability of AI tools also means attackers can condense what once took months of exploit development into a matter of days.

“A year or two ago, attackers were shooting the equivalent of digital arrows at our services,” Geerling said. “Today, I’d say we’re dealing with cruise-missile capabilities. The question is whether our defenses can keep up.”

Limiting exposure remains the best defensive measure.

“The best option is always to remove access where unnecessary,” Geerling said. “If you have a tower site exposed to the internet that is accessible without a VPN, you can bet automated scanners already have it on their list of potential targets.”

FBI guidance

To put in perspective the severity of this week’s threat, the FBI urged organizations to take immediate protective measures.

If an immediate update is not feasible, the FBI recommends taking affected systems offline until mitigations can be applied:

• Update PHP installations: Immediately deploy official patches following guidance on php.net. Inventory all environments running PHP, prioritizing internet-facing systems and third-party vendor products.
• Monitor web traffic: Watch web servers for unusual behavior, including PHP processes unexpectedly executing commands or initiating outbound file downloads. Implement endpoint and process-monitoring tools to spot unauthorized execution.
• Isolate and report intrusions: If indicators of compromise appear, isolate affected machines from the network immediately, preserve all web server and PHP access logs and report the incident to a local FBI field office or through the Internet Crime Complaint Center.

[Do you receive the Radio World SmartBrief newsletter each weekday morning? We invite you to sign up here.]