PHP2Shell Client FAQ

Do we use PHP in any of our systems or tools? If so, where?

Yes, PHP is used for our corporate websites: panalyt.com and panalyt.jp.

They are hosted with Kinsta and use WordPress which is based on PHP.

The corporate websites don’t hold any internal client data, and are hosted on completely separate infrastructure from the Panalyt application.

We’ve also received confirmation from Backlog, which is used for client communications, that their systems are not affected by PHP2Shell.

Is the Panalyt app and related infrastructure that holds client data using PHP?

No, the Panalyt application does not use PHP.

Are assets and systems using PHP using compromised versions of PHP? and if so what is the plan and timeline for updating them?

The corporate websites were based on a compromised version of PHP as of October 21st.

As of October 22nd Kinsta has stated that they’ve:

1. Rolled out patches for affected PHP versions,

2. Prior to that, the Cloudflare-based site protections they use were already blocking attacks against Kinsta-hosted WordPress instances like ours.

For more information see: https://status.kinsta.com/incidents/c0c6xl1ghpb2

Have you noted any suspicious activities in any of the assets/systems which are potentially compromised?

No, we’ve not noticed any suspicious activities in any of our systems, but we continue monitoring our systems and reviewing security disclosures from our subprocessors.

As stated before, our corporate website does not hold client information. Out of an abundance of caution we’ve contacted the 3rd party vendor that is managing the sites to review logs for any signs of attack, and also ensure that the WordPress instances are updated properly.

Our main application does not use PHP in any way so it’s not vulnerable to PHP2Shell. We’ve done a review of the application logs, and Firebase logs, and have not found any signs of unauthorized access. 

In the interest of protecting our clients, we considered the possibility that some users may be re-using credentials on multiple sites including Panalyt, and that those could’ve been compromised elsewhere. 

While we cannot completely rule out unauthorized access through compromised credentials, we’ve not observed any:

• Login attempts at a suspiciously high frequency.
• Logins from new IP addresses.
• Or Logins from high-risk countries.