PHP 基金会在昨晚 10 点发布新版本修复 PHP2Shell 漏洞，网络服务提供商 Cloudflare 已经提前获悉漏洞并通过 WAF 规则部署缓解措施，随后 Cloudflare 开始观测到迅速增加的攻击尝试，目前观测到的攻击尝试已经超过百万次。
Cloudflare 提前部署 WAF 防护规则：
Cloudflare 在 10 月初开始准备规则并在漏洞公开前约 9 小时完成部署，从 10 月 21 日 03:02 UTC 开始，所有启用 Cloudflare WAF 的免费和付费网站都默认获得相关防护。
这次防护使用 Cloudflare 新推出的完整事务检测，将 HTTP 请求与服务器响应结合分析，判断请求是否呈现利用特征，以及服务器是否返回异常结果。匹配规则后 WAF 可以在响应送达请求发起者前将其拦截。这个机制能减少仅凭请求特征判断造成的误报，但无法撤销服务器在响应生成前已经执行的操作。
Cloudflare 拦截的攻击已经超过百万次：
Cloudflare 首席执行官马修普林斯发布推文称，PHP 漏洞公开披露前 10 小时，网络上出现的攻击已经有数千次，这些攻击使用不同的变体组合进行尝试；漏洞披露 45 分钟后这些攻击尝试次数达到数万次，2 小时内达到数十万次，之后攻击尝试已经达到数百万次。
不过这只是 Cloudflare 的观测数据，全网攻击尝试可能会远高于百万级别，而且说不好这个时候已经有黑客得手，部分使用旧版 PHP 的站点已经被黑。
WAF 只能缓解最终还是要升级：
需要特别说明的是即便使用 Cloudflare WAF 也必须升级 PHP，防护规则可以拦截部分攻击尝试，但黑客也在尝试海量的变体组合，所以对使用 PHP 的网站来说当前还是要升级 PHP 版本，升级到不受影响的版本后可以提高安全性，不能仅依靠 WAF 规则。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The PHP Foundation repaired the PHP2Shell loophole last night at 10 point publish. The network service provider Cloudflare had been informed of the loophole and deployed mitigation measures through the WAF Rules, and then Cloudflare began to observe a rapidly increasing attempt at attack, which has now been observed more than a million times.
Cloudflare pre-positioning WAF protection rules:
Cloudflare began preparing the rules early in October and completed its deployment approximately 9 hours before the leak was made public. Starting on 21 October, at 0302 UTC, all free and paid sites using Cloudflare WAF were implicitly protected.
This protection, using Cloudflare ' s newly introduced complete service test, combined HTTP requests with server responses to determine whether the request presented a utilization feature and whether the server returned the abnormal results. After matching the rules, WAF can intercept the request before responding to the request. This mechanism would reduce misstatement based solely on the characteristics of the request, but would not be able to undo operations already performed by the server before the response was generated.
Claudflare has intercepted more than a million attacks:
Claudflare CEO Matthews publish tweets that there have been thousands of attacks on the network 10 hours before the PHP loophole was made public, and that these attacks have been attempted using different variant combinations; 45 minutes after the leak, these attacks have been attempted tens of thousands, hundreds of thousands within two hours, and the subsequent attacks have reached millions.
However, this is only the observation data of Cloudflare, and the Internet attack attempt could be much higher than a million levels, and it is not likely that hackers have already been successful at this time, and sites using the old version of PHP have been hacked in part.
WAF can only mitigate or upgrade:
It needs to be specifically noted that even using the Cloudflare WAF would have to upgrade the PHP, that protection rules would have to stop some of the attacks, but hackers were trying a mass variant combination, so for the PHP version to be used on the PHP site, it would be safer to upgrade to an unaffected version and not rely on the WAF rules alone.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.