Genians: PHP2Shell's Real Ticking Time Bomb Is Inside Internal Networks... "Urgent: Inspect and Patch NAS Devices and Routers"

As the critical security vulnerability “PHP2Shell” is being exploited in real-world attacks, an analysis has warned that companies urgently need to inspect not only web servers exposed to the outside world but also network devices connected to internal networks, including NAS (network-attached storage) devices, routers, and firewalls.

Genians, an integrated AI security platform company, said on October 30 that PHP-based devices on the internal networks of companies and institutions could become new targets for cyberattacks, and urged them to immediately inspect their internal assets and take proactive measures.

Vulnerability response efforts at companies and institutions are often focused on public web servers identified through external scans. However, Genians said attackers are increasingly likely to use NAS devices, routers, and security equipment on internal networks—which are difficult to identify from outside—as points of entry beyond web servers.

The PHP2Shell vulnerability was officially added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on October 26. This means it is being exploited in real-world attacks. Genians warned that attackers could take control of vulnerable devices on internal private IP address ranges that are difficult to access directly from outside, then use them as footholds for lateral movement within a network or to distribute ransomware.

An analysis of device identification data from actual devices connected to Genians’ cloud-based NAC platform also supports these concerns. Of the devices running PHP environments on internal networks, 96% were found to be directly exposed to the PHP2Shell vulnerability.

Of the vulnerable devices, 78% were running versions 8.1 or earlier, for which official PHP support has ended. In particular, devices running version 5.x or earlier, for which support ended in 2018, accounted for 48%.

The problem is that many of the vulnerable devices are not conventional servers. Traditional servers accounted for just 24% of all devices. CCTV and video storage devices, along with security solutions, accounted for 20%, while Internet of Things (IoT) devices such as RFID readers made up 17%. Unidentified assets whose device types could not be determined accounted for 27%.

The fact that these devices are on internal networks and difficult to discover from outside also increases the risk. Of the identified devices, 89% were located on private IP address ranges inaccessible to scanners used by external internet search engines. This means they could be left unattended for long periods while administrators remain unaware that PHP is installed and running on them.

Genians said that relying solely on external scanning tools to check IP addresses one by one makes it difficult to find security blind spots on internal networks. It said the priority is to accurately identify all assets connected to internal networks and establish visibility into them.

Kim Gye-yeon, head of Genians’ U.S. subsidiary and chief technology officer (CTO), said, “To determine whether managed devices on internal networks are running PHP, their web console response data and embedded components must be precisely identified.” Kim added, “Proactive controls are essential for older devices that have reached the end of manufacturer support and have no official patches, as well as devices awaiting patch releases. Network access to these devices must be immediately blocked and they must be isolated until they can be replaced.”

Genians is developing a next-generation asset and threat intelligence platform by advancing its “Genian NAC” asset identification technology using agentic artificial intelligence (AI).

Its core technology, CAASM (Cyber Asset Attack Surface Management), is a security technology that enables companies and institutions to identify and centrally manage their internal IT assets in real time.

Genians plans to reduce blind spots in the attack surface of internal networks that are difficult to identify through external scans alone. It will do so by having AI agents collect and analyze manufacturers’ security advisories, patch information, and vulnerability trends, then map that information to customer assets in real time. The company aims to proactively prevent and block cyber threats to companies and institutions.

This content was produced with the assistance of AI translation services.