Forrester Warns Of IT Visibility Crisis Amid PHP2Shell Security Event

The PHP2Shell security event is rapidly becoming a board-level conversation, with two critical PHP vulnerabilities allowing unauthenticated remote code execution, according to Forrester. Security authorities are urging organizations to patch immediately, but many are struggling to identify and inventory systems running PHP. Forrester reported that this challenge is not unique to PHP, but rather a symptom of a larger IT visibility crisis.

Enterprises have spent decades implementing various management systems, including configuration management databases (CMDBs), application portfolios, and software asset management (SAM) systems, yet they still struggle to answer basic questions about their technology estate. The PHP2Shell event demonstrates how difficult it can be to determine where PHP is running, whether it is active, and whether it is exposed to the internet.

PHP can be packaged with an operating system, embedded in another product, or installed but inactive, making it hard to detect. Different management systems see different pieces of this reality, and the real question is whether organizations have real-time, comprehensive, and reliable visibility into their technology estate. Forrester notes that this requires connecting evidence across systems built for different use cases.

PHP is an open-source programming language and runtime that can be acquired through downloading, without a procurement record or commercial event signaling its presence. It may not appear as a neatly installed, standalone software product, but rather as an operating-system package or exposed through web-serving configurations. The Netherlands' National Cyber Security Centre warns organizations to check embedded and third-party instances separately, complicating an already difficult inventory problem.

To build visibility, organizations need to collect and connect evidence from multiple IT management and security systems. These systems include CMDBs, software asset and infrastructure discovery, software composition analysis, and runtime and configuration evidence. Each system provides a different view of reality, and none provides a complete view on its own. Forrester advises organizations to normalize and translate discovered evidence into consistent vendor and product naming.

The CMDB should provide context, not pretend to be omniscient, according to Forrester. It doesn't need to become a gigantic repository, but rather a navigation system that connects relationships among different evidence sources. Dynamic workloads, such as containers and Kubernetes, require a different approach, relying less on persistent inventories and more on telemetry and runtime evidence.

The hardest question is proving that something isn't there, such as proving that there are no unpatched PHP instances. Running a query against the CMDB or returning zero results doesn't prove it, and neither does an empty SAM query or an SCA search. Forrester notes that confidence comes from correlating independent evidence about presence, runtime state, and configuration.