There is a critical distinction between two types of attacks: compromising individual websites within a hosting subscription and gaining command-line or root access to the underlying server.
The former is serious but typically limited to activities such as distributing spam, hosting phishing pages, or attacking other systems. The latter potentially compromises the entire server.
PHP2Shell exploits fall into this far more dangerous category, as does the newly disclosed vulnerability. The particular concern is that attackers who already control compromised websites could escalate their access. By uploading custom PHP scripts and manipulating certain PHP settings, they may be able to establish the conditions necessary for a PHP2Shell exploit, turning an isolated website compromise into a server-wide security breach.
For this reason, I believe describing the scenario as "unlikely" significantly understates the risk. Once an attacker has compromised a hosting subscription, they may be able to deliberately establish the conditions required for exploitation. What might otherwise be considered an unlikely scenario can thus become a deliberately prepared, attack-ready environment.
And for the same reason I believe that disabling user defined .ini files plus disabling session.upload_progress.enabled is essential - until PHP provides another fix for the mess.
Facebook
Twitter
