96% of corporate intranet devices exposed to PHP vulnerability... “Immediately isolate devices that cannot be patched”

[Financial News] An analysis has found that 96% of devices running PHP on corporate intranets worldwide are exposed to the critical security vulnerability PHP2Shell. Moreover, many vulnerable devices use outdated software that is no longer supported and are located on private networks that are difficult to detect from outside, raising concerns that conventional security checks alone are insufficient to address the threat.
Genians Inc., a cybersecurity company, said on the 30th that an analysis of device-identification data collected on its cloud network access control (NAC) platform found the PHP2Shell vulnerability to be widespread among various network devices connected to corporate intranets.
The analysis found that 96% of intranet devices running PHP were exposed to the PHP2Shell vulnerability. Of the vulnerable devices, 78% were running PHP versions 8.1 or earlier, which are no longer officially supported. Devices running PHP 5.x or earlier accounted for 48% of all vulnerable devices.
Vulnerable devices were found across a range of network equipment, not just conventional web servers. Traditional servers accounted for 24%; CCTV and video-storage devices, along with security solutions, made up 20%; and Internet of Things (IoT) devices such as RFID readers accounted for 17%. Unidentified assets whose device type could not even be determined made up 27%.
In particular, 89% of the identified devices were located in private Internet Protocol (IP) ranges that external internet search engines and scanners cannot access. This means that conventional vulnerability checks focused on publicly accessible web servers make it difficult to identify vulnerable devices hidden within intranets.
PHP2Shell is a critical security vulnerability that allows an attacker to remotely seize control of a system without any separate authentication. Its listing on the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on the 26th confirmed that it had been exploited in actual attacks.
Genians warned that potential targets could expand beyond external web servers to include network-attached storage (NAS) devices, routers and firewalls on intranets. The company said that if an attacker takes control of a vulnerable device, they could use it as a foothold to infiltrate other systems on the intranet or distribute ransomware.
The company stressed the need to move beyond existing security measures focused on external scans and web-server patching, and to identify and manage all assets across intranets. It recommended blocking network access to or isolating outdated devices that can no longer be patched because manufacturer support has ended, until they are replaced.
Kim Gye-yeon, head of Genians’ U.S. subsidiary and chief technology officer (CTO), emphasized, “For managed devices located on intranets, we can determine whether they are running PHP only by precisely identifying web-console response data and embedded components.” He added, “In particular, for older devices that are no longer supported by the manufacturer and have no official patches, or devices for which patches have not yet been released, proactive controls to immediately block network access or isolate them until they are replaced are essential.”
[email protected] Choi Hye-rim Reporter