Mana bashorat: biz ilova xavfsizligi kompaniyalari uchun ajoyib chorakni ko'rish arafasida turibmiz. PHP2Shell ilova xavfsizligi sotuvchilari yillar davomida olgan eng kuchli byudjet argumentiga aylanadi. AI tadqiqotchilarga vebning 69% ni tashkil etuvchi til ichida ikkita masofaviy kod bajarish zaifligini topishga yordam berdi, hujumchilar patch yetkazilishidan oldin uni nishonga oldilar, va taklif o'z-o'zidan yoziladi: ko'proq xatolarni toping va ularni tezroq tuzating.
Korxonalar bu fikrni qayta ko'rib chiqishi kerak. Xavfsizlik jamoalari mashina tezligida patch qila olmaydi, lekin ular ekspluatatsiyadan keyin hujumchi erisha oladigan narsani kamaytirishi mumkin — identifikatsiyani nazorat tekisligi sifatida e'tiborga olish orqali.
Dastlabki ekspluatatsiyadan tashqari, yakuniy hodisa jiddiyligi asosan buzilgan ish yuklamasi foydalanishi mumkin bo'lgan qaysi xizmat hisoblari, API kalitlari, bulut rollari va tokenlar va ular nimaga kirishi mumkinligiga bog'liq.
Zaiflikdan ekspluatatsiyaga
Birinchidan, ekspluatatsiya hozir qanchalik tezroq ekanligini tushunishimiz kerak. PHP2Shell ortidagi ikkita kamchilik PHP kodida 2012-yildan beri mavjud edi. Calif va Wiz tadqiqotchilari ularni avgustda topdilar, OpenAI va Google modellari yordamida, va OpenAI bilan birgalikda oshkor qildilar.
Amazon 17-oktabrda, oshkor qilishdan to'rt kun oldin ekspluatatsiya urinishini ko'rdi. PHP 21-oktabrda patchni yetkazdi, va watchTowr o'sha kuni yovvoyi tabiatda ekspluatatsiya urinishlarini ko'rdi. Cloudflare oshkor qilishdan keyin hujum trafigi tez o'sib borayotganini kuzatdi, va 26-oktabrda CISA ikkala kamchilikni ma'lum ekspluatatsiya qilingan zaifliklar ro'yxatiga qo'shdi.
Ekspluatatsiya hozir ko'pincha oshkor qilishdan oldin boshlanadi. Afsuski, tuzatish tomonida ishlar tez harakatlanmayapti. Verizonning 2026 DBIR ma'lum ekspluatatsiya qilingan zaiflikni tuzatishning median vaqti 43 kun ekanligini bildiradi. Qualys ma'lumotlariga ko'ra, o'rtacha tuzatish vaqti 21,2 kun, va muhim zaifliklarning 63% bir haftadan keyin ham ochiq qoladi. Bularning barchasi har kuni taxminan 195 ta yangi CVE e'lon qilinayotganda sodir bo'lmoqda.
PHP2Shell ko'pchilikdan ko'ra tozalash uchun ko'proq vaqt oladi. PHP qurilmalar va hosting nazorat panellari ichida yetkaziladi, ularni mijozlar o'zlari patch qila olmaydi. Bundan tashqari, 8.1 va undan eski versiyalar rasmiy qurilmalarga ega bo'lmadi.
27-oktabr holatiga ko'ra, Censys internetga ochiq 32,5 million PHP xizmatlari hali ham potentsial zaif versiyalarni ishlatayotganini, va 60 milliondan ortiq boshqalar esa umuman versiya haqida xabar bermasligini sanadi.
Qanday qarasangiz ham, tuzatish tezligi yaqin kelajakda ekspluatatsiya tezligidan sekinroq qoladi, hatto patchlashning o'zi AI bilan boshqariladigan ish oqimlaridan katta foyda ko'rsa ham.
Har bir Agentga Identifikatsiya Kerak
Agentlar hozir sizning tizimlaringiz bo'ylab hech kim ko'rib chiqmagan kirish huquqi bilan harakat qilmoqda.
Token Security'ning AI Agent Security har bir agentni topadi, uni egasi bilan bog'laydi va u nima qila olishini cheklaydi. Agentik AI tartibsizligini nazorat qilish uchun identifikatsiyaga asoslangan tartib
Tokenni Amalda Ko'ring
Topish tuzatish emas
Ekspluatatsiya bo'shlig'i kengayib borayotganda, to'lqinni ushlab turish uchun hamma narsani sarmoya qilish jozibador. Ammo hatto AI bilan boshqariladigan skan ertaga sizning muhitda 2000 ta yangi nol-kun zaifligini topsa ham, bu kuchliroq xavfsizlik holatiga olib kelmaydi.
Bu sizga ro'yxat beradi. Ba'zi elementlarni patch qilish oson bo'ladi, boshqalari esa jamoangizda bor vaqtdan ko'proq vaqt talab qiladi.
Qo'llab-quvvatlanadigan PHP tarmoqlari uchun to'g'ridan-to'g'ri tuzatish oddiy edi: yangilangan relizni o'rnating. Hukumatlar va kompaniyalar hali ham o'z saytlarini kutish davomida oflayn qildilar.
Mana boshqa, optimistikroq qarash. Zaifliklar ekspluatatsiyalarga olib keladi, va ekspluatatsiyalar hujumlarga, lekin korporativ kontekstda hujumning ta'siri buzilgan identifikatsiyalar qanchalik uzoqqa yetishi mumkinligi bilan aniqlanadi. PHP serveridagi shell hujumchiga o'sha server o'qishi mumkin bo'lgan hamma narsaga kirish beradi — muhit o'zgaruvchilaridan tortib konfiguratsiya fayllaridagi bulut kalitlarigacha.
PHP2Shell shuningdek, ishchi xotirasini, jumladan parollar, tokenlar va API kalitlarini sizdirishi mumkin. Bir hostda kod bajaradigan hujumchi eshikni ochadi, lekin haqiqiy qimmatbaho narsalar odatda qulflangan xonalarda.
Va lateral harakatni cheklaydigan nazoratlar kashfiyotga qarshi poygada g'alaba qozonishga bog'liq emas. Zaifliklarni topish ochiq jarayon, va xizmat hisobining yetish doirasini cheklash esa o'lchanadigan vazifa.
Hujumchilar eng oson yo'lni tanlaydi
Bu yondashuv cheklovlarga ega. Agar zaiflik IdP yoki sirlar menejerida bo'lsa, lateral harakat qobiliyatlari ichki o'rnatilgan. Agar u ma'lumotlar bazasida yoki saqlash provayderida bo'lsa, hujumchi allaqachon o'zi xohlagan joyda.
Shunday qilib, cheklangan resurslar bilan zaiflik-birinchi yondashuvda qolish jozibador: maslahatlar va skanerlar topgan narsalarni kataloglash, triage qilish, yuqoridan pastga ishlash. Ammo kataloglash haftalar oladi, va eng muhim topilmalarni tuzatish esa undan ham uzoqroq. Bu yerda garov shuki, sizning asosiy tizimlaringizdagi eng ekspluatatsiya qilinadigan teshiklar siz birinchi bo'lib yopadigan teshiklar bo'ladi.
Bu garov zaiflikning jiddiyligini (CVSS balli) portlash radiusidan ustun qo'yadi. Hujumchilar eng to'g'ridan-to'g'ri yo'lni izlamayapti; ular eng oson yo'lni izlayapti. Sizdirilgan ma'lumotni olish va u bilan harakat qilish, ma'lumotlar bazasiga to'g'ridan-to'g'ri yetish uchun nol-kun zaifliklarini birlashtirishdan osonroq.
Oktyabrning boshqa sarlavhalari bu yo'lni ko'rsatadi. LiteLLM'da hujumchilar jamoat omborida ochilgan asosiy kalitdan foydalanib, ichki agent platformasidan cheklanmagan GitHub tashkilot-egasi tokenini olishdi. Bu identifikatsiya ularga yana ikkita maintainer tokenini o'g'irlash, reliz ish oqimini buzish va ma'lumot o'g'irlovchi artefaktlarni nashr etish imkonini berdi.
Portlash radiusini birinchi bo'lib qisqartiring
Siz har bir serverni hujumchilar kelishidan oldin patch qilish poygasida g'alaba qozona olmaysiz, lekin siz buzilgan server hujumchilar uchun qanchalik qimmatli ekanligini aniqlashingiz mumkin. Har bir AI agent va inson bo'lmagan identifikatsiyani toping va inventarizatsiya qiling, va eng ko'p yetadiganlarni xavfsizlashtirishdan boshlang.
Egasini tayinlang, kirishni maqsad va niyatga cheklang, ishlatilmayotgan ma'lumotlarni olib tashlang va identifikatsiya hayot siklini doimiy ravishda boshqaring. AI agentlari uchun yanada oldinga borib, kirishni niyat bo'yicha bering. Bu identifikatsiyani nazorat tekisligi sifatida davolash deganidir.
Patchlash siz teshikni qanchalik tez yopishingizni hal qiladi. Identifikatsiya esa siz yopish mumkin bo'lmaganda hujumchi qanchalik ko'p narsani olishini hal qiladi.
Token Security'dan ko'proq ko'rish uchun, jamoamiz bilan texnik demo buyurtma qiling.
Token Security tomonidan homiylik qilingan va yozilgan.
Here's a prediction: we're about to see a stellar quarter for application security companies. PHP2Shell is about to become the strongest budget argument application security vendors have had in years. AI helped researchers find two remote code execution vulnerabilities in the language behind 69% of the web, attackers targeted it before the patch shipped, and the pitch writes itself: find more bugs and fix them faster.
Enterprises should rethink this idea. Security teams cannot patch at machine speed, but they can reduce what an attacker can reach after exploitation by focusing on identity as the control plane.
Beyond the initial exploitation, the ultimate incident severity depends heavily on which service accounts, API keys, cloud roles, and tokens the compromised workload can use and what they can access.
From vulnerability to exploitation
First, we need to understand just how much faster exploitation is now. The two flaws behind PHP2Shell had been in PHP's code since 2012. Researchers at Calif and Wiz found them in August, with help from OpenAI and Google models, and disclosed them jointly with OpenAI.
Amazon saw an exploitation attempt on October 17, four days before disclosure. PHP shipped the patch on October 21, and watchTowr saw exploitationattempts in the wild the same day. Cloudflare observed attack traffic escalating rapidly after disclosure, and on October 26, CISA added both flaws to its list of known exploited vulnerabilities.
Exploitation now often starts before disclosure. Unfortunately, things aren't moving as quickly on the remediation side. Verizon's 2026 DBIR states the median time-to-fix of a known exploited vulnerability is 43 days. According to Qualys, the mean remediation time is 21.2 days, and 63% of critical vulnerabilities are still open after a week. All while around 195 new CVEs are published every day.
PHP2Shell will take longer than most to clean up. PHP ships inside appliances and hosting control panels that customers can't patch themselves. Moreover, versions 8.1 and older got no official builds.
As of October 27, Censys counted 32.5 million internet-facing PHP services still running potentially vulnerable versions, and more than 60 million others that don’t report a version at all.
However you look at it, remediation speed will remain slower than the pace of exploitation for the foreseeable future, even when patching itself benefits greatly from AI-driven workflows.
Every Agent Needs an Identity
Agents now act across your systems with access nobody has reviewed.
Token Security’s AI Agent Security finds every agent, links it to an owner, and limits what it can do. Identity-based order to control the chaos of your agentic AI
See Token in Action
Finding isn't fixing
With the exploitation gap widening, it’s tempting to invest everything you can in holding back the tide. But even if an AI-driven scan found 2,000 new zero-day vulnerabilities in your environment tomorrow, that won’t result in a stronger security posture.
It will give you a list. Some items will be easy to patch, while others will need more time than your team has.
For supported PHP branches, the direct fix was simple: install the updated release. Governments and companies still took their sites offline while they waited for it.
Here's another, more optimistic way to look at it. Vulnerabilities lead to exploits, and exploits lead to attacks, but in an enterprise context, the impact of an attack is determined by how far the compromised identities can reach. A shell on a PHP server grants the attacker access to whatever that server can read, from environment variables to cloud keys in config files.
PHP2Shell can also leak worker memory, including passwords, tokens, and API keys. An attacker executing code on one host opens a door to a hallway, but the real valuables are usually in locked rooms.
And the controls that limit lateral movement don't depend on winning a race against discovery. Finding vulnerabilities is an open-ended process, and limiting the reach of a service account is a quantifiable task.
Attackers take the easiest path
This approach has limits. If the vulnerability is in the IdP or the secrets manager, lateral movement capabilities come built in. If it's in the database or in the storage provider, the attacker is already where they want to be.
So with limited resources, it's tempting to stay vulnerability-first: catalog what the advisories and scanners found, triage it, work down from the top. But cataloging takes weeks, and fixing the most pressing findings takes even longer. The bet here is that the most exploitable holes in your core systems are the ones you'll close first.
That bet prioritizes the vulnerability’s severity (the CVSS score) over the blast radius. Attackers aren't looking for the most direct path; they're looking for the easiest path. Taking a leaked credential and moving with it is easier than stringing together zero-days to reach a database directly.
October's other headlines show that path. At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform. That identity let them steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts.
Shrink the blast radius first
You can’t win the race to patch every server before the attackers arrive, but you can determine what a compromised server is worth to them. Discover and inventory every AI agent and non-human identity and start by securing the ones that reach the most.
Assign an owner, scope access to purpose and intent, remove dormant credentials, and continuously govern the identity lifecycle. For AI agents, go further and grant access by intent. That is what it means to treat identity as the control plane.
Patching decides how fast you close a hole. Identity decides how much an attacker gets when you can’t.
To see more from Token Security, book a technical demo with our team.
Sponsored and written by Token Security.