Vulnerabilities
Mirai Botnet Operators Linked to PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Researchers have tied recent PHP2Shell attack attempts to a Mirai botnet and documented ASLR bypass exploits, SecurityWeek reports, though no successful compromise has been confirmed so far.
SecurityWeek reports that researchers have tied a wave of PHP2Shell attack attempts to operators of a Mirai botnet, while separately documenting exploit code that bypasses Address Space Layout Randomization (ASLR), a core memory-protection mechanism. According to the report, no successful compromise has been confirmed so far.
PHP2Shell refers to a long-running family of attacks in which adversaries exploit vulnerabilities in PHP-based web applications and servers to force them to fetch and run malicious shell scripts. Mirai is a botnet malware family best known for infecting Linux-based Internet-of-Things devices and conscripting them into networks used to launch large distributed denial-of-service attacks. The reported linkage suggests Mirai operators are now attempting to abuse PHP flaws as an additional infection vector.
ASLR randomizes where code and data sit in memory, making many exploits unreliable. The emergence of working ASLR bypass exploits, as described by SecurityWeek, could make exploitation of the targeted weaknesses more practical, raising the stakes even though no breach has yet been verified.
Because PHP2Shell-style campaigns typically rely on unpatched web application flaws, defenders generally advise keeping PHP frameworks and content management systems up to date, restricting outbound connections from web servers, and monitoring logs for suspicious script downloads. Details in this story come from SecurityWeek.
Source: SecurityWeek
