SGA Solutions announced on October 28 that it will provide emergency response support utilizing its solutions to address the recently disclosed PHP security vulnerability known as PHP2Shell. The company offers a multi-layered defense approach based on its server vaccine, vAegis, and server security solution, RedCastle, which restricts attacks through security rules and policies without directly modifying the code.
PHP2Shell is a high-risk vulnerability found in the widely used PHP engine for web services, allowing attackers to execute code remotely without authentication. Successful attacks can lead to web shell installations, customer data breaches, website tampering, and internal network intrusions. Reports of related attack attempts have emerged overseas, prompting the Korea Internet & Security Agency (KISA) to recommend swift security updates and response measures for companies using PHP.
The top priority for addressing the vulnerability is a security update. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 or higher. Versions 8.1, 8.0, and 7.4 do not have official releases, so security updates from distribution or LTS vendors or source backports from the PHP security team must be applied. Versions 7.3 and below lack patches and require migration to supported versions. However, immediate application may be challenging depending on the operational environment.
Virtual patching limits attacks by applying detection and blocking rules from security solutions instead of directly modifying vulnerable code. While it does not eliminate the vulnerability itself and cannot replace formal security updates, it serves as a supplementary measure to reduce attack risks during periods when patching is difficult.
SGA Solutions emphasized that transitioning older PHP environments to supported versions requires application modifications and compatibility verification, considering the potential impact on operations due to service interruptions. Therefore, supplementary measures to control attacks are necessary while preparing for updates.
Meanwhile, Node.js has also recently addressed multiple vulnerabilities, including a Brotli decoder vulnerability, through security updates (22.23.4, 24.22.1, 26.12.1). SGA Solutions plans to prioritize patch application for customers operating Node.js-based services and expand the scope of internal behavior control policies.
In the first phase, the host-based intrusion prevention (Host IPS) feature of the server vaccine vAegis will apply response rules tailored to customer environments to control incoming attack requests and protect server workloads across on-premises, virtual, and cloud environments.
In the second phase, the server security solution RedCastle will control the behavior of web processes at the operating system kernel level. Policies will be applied to restrict unnecessary command executions and access to critical files and directories, limiting malicious activities that may occur internally after bypassing initial detection. This creates a multi-layered defense structure that combines response rules for attack requests with process behavior control.
SGA Solutions recommends that organizations review their server protection systems in light of this vulnerability. A company representative stated, "It is crucial to have a system in place that continuously protects servers alongside patching individual vulnerabilities. Companies and institutions that have already implemented protection solutions should also check the status of their security policies and the normal operation and updates of the server vaccine (vAegis)."
SGA Solutions plans to support the application and configuration of response policies based on customers' operating systems, PHP usage environments, and service characteristics. Additionally, it will offer vAegis and RedCastle free for one month to companies and institutions requiring rapid response.
Choi Young-cheol, CEO of SGA Solutions, stated, "While applying patches is the top priority, environments where immediate patching is not feasible need supplementary measures to reduce exposure to attacks during the update preparation period. We will enhance the response policies of vAegis and RedCastle, which combine host-based intrusion prevention and kernel-level behavior control, to strengthen our server security technology competitiveness."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.