Moncho Padrón (Automattic), on PHP2Shell: “The real challenge is in the servers that no one actively maintains”

Of the vulnerabilities in PHPthe most widespread open source programming language on the servers that host the world’s web pages and applications, They put the entire internet on alert last Wednesday given its reach (it is estimated that it is used on about 70 percent of websites) and the risk of exploitation.

The threat posed by the two vulnerabilities, known as PHP2Shell, is not trivial; give rise to an actor malicious executes its own code on affected serversto take control and maliciously alter websites or steal data.

For the head of Spanish-Speaking Communities and Growth at Automattic, the company behind WordPress.com, Moncho Padrón, it was a “proportionate” response, since, as he explained in statements to Europa Press, “a vulnerability that allows taking control of a server without credentials, in such a widespread technology, is a serious matter.”

The risk lay mainly in the fact that the information about the vulnerabilities and the publication of the patch did not follow the same rhythm despite both being officially made public on the same day. “Information about the vulnerabilities was leaked earlier of coordinated dissemination,” Padrón noted.

This gave rise to exploitation attempts and proofs of concept, even a few days before the information embargo expired, although, as the head of Spanish-speaking communities and growth at Automattic has clarified, “that does not equate to confirmed and functional exploits, but it demonstrates the speed with which attackers begin to test.

“Before, days or weeks could pass between a vulnerability becoming public and its massive exploitation. Today, With AI making that process faster and cheaper, that margin is getting shorter and shorter“, he added.

Padrón has also clarified that PHP2Shell “does not only affect obsolete versions” of PHP, but the vulnerabilities extend “to a wide range of versions and configurations.” “The difference is that the supported versions already have patches available and the old ones do not,” he noted.

“THE IMPACT HAS NOT BEEN THE SAME FOR EVERYONE”

As these are vulnerabilities present in the server language, the update depended on the speed at which developers will act that manage their own servers and those of hosting providers.

The WordPress community is one of the largest globally, since, as an open source project, it powers more than 40 percent of the web. Given the PHP2Shell problem, Padrón has confirmed that “Automattic worked with the PHP security team so that all sites hosted on their platformsincluding WordPress.com, WordPress VIP, Pressable and Tumblr, were protected as soon as possible“.

However, when it comes to websites created with WordPress, he clarified that “Each site runs on the infrastructure of your hosting provider“and, therefore, “the impact has not been the same for everyone.”

“The real challenge is in servers that no one actively maintains or that are still running on old versions. According to WordPress.org, more than a third of WordPress websites run on versions of PHP that They no longer have official support“, he pointed out.

“EVERY SOFTWARE HAS VULNERABILITIES”

When asked if the Internet is built on languages ​​and architectures that put data at risk, Padrón does not believe that “the Internet is built on fragile foundations”and remember that “all software has vulnerabilities, including the owner.”

“The advantage of open source [como es PHP] is that vulnerabilities can be transparently detect, coordinate and correctwhich is exactly what has happened here,” he added and then concluded that “the real risk is not in the programming language, but in how we maintain what we build.”