Amazon PHP2Shell zaifliklaridan foydalanish yamoqlardan 4 kun oldin boshlanganini aytmoqda
Sergiu Gatlan tomonidan
2026-yil 22-oktabr 09:09 0
Amazon Threat Intelligence xavfsizlik tadqiqotchilari hujumchilar PHP2Shell zaifliklarini chorshanba kuni chiqarilgan xavfsizlik yamoqlaridan to'rt kun oldin nishonga olishni boshlaganini aytishmoqda.
CVE-2026-109618 va CVE-2026-109619 sifatida kuzatilgan bu ikki muhim zaiflik hujumchilarga zaif tizimlarda masofadan kod bajarish (RCE) imkoniyatini beradi. PHP xavfsizlik jamoasi ularni 21-oktabrda yamadi, bir kun oldin esa ma'murlarga yangilanishlarni tezda o'rnatishga tayyorlanishni so'ragan edi.
PHP asosiy ishlab chiquvchisi Gina Peter Banyard ochilishdan oldin rasmiy xavfsizlik yamoqlarini qo'llash yagona doimiy himoya ekanligini ogohlantirdi, Buyuk Britaniya Milliy Kiberxavfsizlik Markazi (NCSC) esa Buyuk Britaniya tashkilotlaridan PHP serverlarini darhol yangilashni yoki ular yamalguncha oflayn qilishni so'radi.
PHP jamoasi hamma narsa reja bo'yicha ketganini aytadi, lekin muvofiqlashtirilgan ochilishdan ikki kun oldin, 20-oktabrdan boshlab maqsadli chiqarish sanasini tezlashtirishga majbur bo'ldi, chunki PHP2Shell xavfsizlik zaifliklari haqida ba'zi tafsilotlar (jumladan, ikkita CVE identifikatori va ba'zi muhim infratuzilma provayderlariga taqdim etilgan yumshatish maslahati) onlayn tarzda sizib chiqqan edi.
Ba'zi isbotlovchi kontseptsiyalar ham yamoqlardan oldin e'lon qilingan bo'lsa-da, PHP xavfsizlik jamoasi ularning hech biri ishlamaganini aytdi.
Amazon Threat Intelligence hisoboti bir nechta kiberxavfsizlik kompaniyalari (jumladan, Cloudflare, watchTowr, Previdian, Hadrian va Patchstack) ommaviy ochilishdan oldin muvaffaqiyatsiz foydalanish urinishlarini aniqlaganidan keyin keldi.
"Keng tarqalgan holda foydalanilmoqda"
Amazonga ko'ra, birinchi foydalanish urinishlari shanba, 17-oktabrda (PHP2Shell yamoqlari chiqarilishidan to'rt kun oldin) boshlangan va hujumchilar ochilishdan bir necha soat o'tib VPN IP manzillaridan bir nechta isbotlovchi kontseptsiya PHP2Shell eksploitlarini joylashtirgan.
"Foydalanish urinishlari tijorat anonimlashtirish tarmog'i bilan bog'liq IP manzildan kelib chiqqan. Zaiflik embargo ostida bo'lganida, anonimlashtirilgan IP manzildan asalari nishonga olish faoliyati tahdid aktori tomonidan amalga oshirilganini ko'rsatadi, garchi aktor ochilishdan oldin eksploit ma'lumotlarini qanday olganligi noaniq qolmoqda," dedi AWS bosh axborot xavfsizligi direktori CJ Moses.
"Haqiqiy yuklamalar va anonimlashtirish infratuzilmasidagi tanlovlar turlicha edi, bu bir nechta aktorlar ekanligini ko'rsatadi. Texnik tahlil davom etmoqda va bu urinishlardan birortasi haqiqiy tizimlarda muvaffaqiyatli bo'lgan-bo'lmaganligi noaniq."
Moses shuningdek, PHP2Shell zaifliklari "hozirda keng tarqalgan holda foydalanilmoqda" deb ogohlantirdi va "himoyachilar ommaviy ochilish sanasi foydalanishning eng erta sanasi deb o'ylamasliklari kerak" deb ta'kidladi.
PHP (Hypertext Preprocessor) ochiq manbali veb-ishlab chiqish tili bo'lib, Internetdagi barcha veb-saytlarning 80% gacha qismini quvvatlaydi, jumladan, WordPress, Drupal va Joomla kabi mashhur Kontent Boshqaruv Tizimlari (CMS) ishlatadigan saytlarni ham.
VirusTotal hozirda onlayn tarzda ochiq bo'lgan 5,1 milliondan ortiq PHP xostlarini kuzatmoqda, ularning taxminan 3,8 millioni hujumlarga ochiq kamida bitta portga ega.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
The Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Tegishli maqolalar:
PHP muhim PHP2Shell zaifliklari uchun favqulodda yamoqlarni chiqaradi
PHP ma'murlarga ikkita muhim zaiflik haqida ogohlantiradi, favqulodda yamoqlar ertaga keladi
Xakerlar AWS, Azure maxfiy ma'lumotlarini o'g'irlash uchun ochiq Vite dev serverlarini nishonga oladi
CISA: Xakerlar Plex zaifliklarini Plex2Shell hujumlarida serverlarni buzish uchun birlashtiradi
Xakerlar SiteGuard WAF zaifligidan foydalanib, ma'mur sifatida buyruqlarni bajaradi
Amazon says PHP2Shell exploitation began 4 days before patches
By Sergiu Gatlan
October 22, 2026
09:09 AM
0
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.
Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let attackers gain remote code execution (RCE) on vulnerable systems. The PHP security team patched them on October 21 after urging admins one day earlier to prepare to install the updates as soon as they became available.
PHP core developer Gina Peter Banyard warned before disclosure that applying the official security patches is the only permanent defense, while the UK National Cyber Security Centre (NCSC) asked UK organizations to immediately update PHP servers or take them offline until they can be patched.
The PHP team says that everything went according to plan until two days before the coordinated disclosure, when it had to speed up the targeted release date starting October 20 after some details on the PHP2Shell security flaws (including the two CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online.
While some proof of concepts were also published before patches were released, the PHP security team said none were functional.
Amazon Threat Intelligence's report comes after multiple cybersecurity companies (including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack) detected unsuccessful exploitation attempts before public disclosure.
"Broadly exploited in the wild"
According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released), and attackers deployed multiple proof-of-concept PHP2Shell exploits hours after disclosure from VPN IP addresses.
"The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," said AWS chief information security officer CJ Moses.
"The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems."
Moses also said that the PHP2Shell vulnerabilities are "now being broadly exploited in the wild" and warned that "defenders should not assume the public disclosure date is the earliest date of exploitation."
PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet, including those using popular Content Management Systems (CMS) like WordPress, Drupal, and Joomla.
VirusTotal now tracks more than 5.1 million PHP hosts exposed online, with roughly 3.8 million with at least one port open to attacks.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
PHP ships emergency patches for critical PHP2Shell flaws
PHP warns admins of two critical flaws, emergency patches coming tomorrow
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Hackers exploit SiteGuard WAF flaw to run commands as admins