Xakerlar internetga ochiq PHP infratuzilmasini ommaviy tarqalgan PHP2Shell eksploit skriptlari bilan keng qamrovda skan qilmoqda, bu esa ikkita muhim zaiflikning oshkor etilishini butun dunyo bo'ylab razvedka kampaniyasiga aylantirmoqda.
Fastly 22-oktabr tushgacha taxminan 250 000 so'rovni PHP2Shell nomli vositalardan, taxminan 3 200 ommaviy IP manzildan qayd etdi. Biroq, bu raqamlar himoya skanerlarini ham o'z ichiga oladi va serverlarning muvaffaqiyatli buzilishini tasdiqlamaydi.
Faoliyat CVE-2026-109618 va CVE-2026-109619 zaifliklarini nishonga oladi, ular birgalikda PHP2Shell deb ataladi va CVSS ballari 9.2 ni tashkil etadi.
Har ikkala zaiflik PHP dvigateliga ta'sir qiladi va ma'lum sharoitlarda autentifikatsiyasiz masofaviy kod bajarilishini ta'minlashi mumkin.
Zaifliklar ilova kodidan pastda joylashganligi sababli, kontentni boshqarish tizimini yangilashning o'zi asosiy xavfni bartaraf etmaydi.
Nashr vaqti kelganda, 100 dan ortiq manba IP manzillari ikki o'nlabdan ortiq nomli vositalarni joylashtirgan edi, jumladan, User-Agent sarlavhasida CVE identifikatorini reklama qiladigan eksploit to'plami ham bor edi.
Eng keng tarqalgan to'plam /index.php yoki / ga POST so'rovlarini yubordi, User-Agent sifatida php2shell-109618 dan foydalandi va B7kQpoc618 ko'p qismli chegarasini taqdim etdi.
So'rovlar xost nomlari emas, balki xom IP manzillariga yo'naltirildi, odatda har bir xostga bir yoki ikki marta urildi.
Bu naqsh nomlangan tashkilotlarga yo'naltirilgan hujum emas, balki manzil maydonini tasodifiy skan qilishni ko'rsatadi.
Fastly o'nta ortiq nomzod eksploit to'plamini aniqladi, ular doimiy yoki naqshli ko'p qismli chegaralar orqali, beshtasi esa nom, sarlavha yoki xatti-harakat orqali to'g'ridan-to'g'ri PHP2Shell bilan bog'langan.
Qayd etilgan trafikning taxminan uchdan bir qismi o'zini himoya tekshiruvi sifatida aniqladi, garchi bunday yorliqlar mustaqil ravishda ruxsatni isbotlay olmasa ham.
CVE-2026-109618 ichki so'rov ma'lumotlarining boshlang'ich holatini to'xtatadigan xotira tugashi holatini o'z ichiga oladi, bu esa tozalash tartibotlarini nomuvofiq holat bilan ishlashga majbur qiladi.
zif_system ga uzatilgan argument soxta zend_string dan olingan buyruqdir. Buyruq veb-server foydalanuvchisi (odatda www-data) huquqlari bilan bajariladi.
Ekspluatatsiya oqimi diagrammasi (Manba: Akatsuki Legion).
Akatsuki Legion texnik tahliliga ko'ra, birinchi PHP2Shell nomli skaner 21-oktabr 03:59 UTC da paydo bo'ldi, bu rejalashtirilgan xavfsizlik nashridan to'qqiz soatdan ortiq oldin.
CVE-2026-109619 ichki holatni uni qo'llab-quvvatlayotgan xotiradan tashqarida saqlab qolishiga imkon beradi, bu esa keyingi so'rovni, xuddi shu ishchi tomonidan ishlov beriladigan, buzilgan ma'lumotlarga duchor qilishi mumkin.
Bu sharoitlar PHP2Shell ni universal yuklama orqali ishonchli tarzda ishga tushiriladigan zaifliklardan ajratib turadi. Sansec yangilangan bahosiga ko'ra, ommaviy isbot-konsept skriptlari standart PHP o'rnatishlarida ishlamadi.
Ma'lum tuzatilgan nashrlarni filtrlash orqali, so'rov zaif infratuzilmaning doimiy asosini muvaffaqiyatli xaritaladi va vaqt chizig'i bo'ylab 274 ta alohida hodisani qayd etdi.
30 kunda 274 hodisa (Manba: Akatsuki Legion).
Ko'pchilik qo'shimcha ilova zaifliklarini, jumladan mahalliy fayl kiritishni, yoki sun'iy zaif test muhitlarini talab qildi. Shuning uchun keng qamrovli skanlash keng qamrovli muvaffaqiyatli ekspluatatsiya bilan tenglashtirilmasligi kerak.
Recorded Future ham ommaviy omborlar ekspluatatsiya qobiliyatini reklama qilishi funksional ekspluatatsiyani tasdiqlamasligini ogohlantirdi.
Ba'zi vositalar bekor qilingan nazariyalarga tayanadi, bu esa ishlaydigan hujum zanjirlarini tasodifiy tekshiruvlar va chalg'ituvchi namoyishlardan ajratish zarurligini kuchaytiradi.
Himoyachilar shuningdek, bog'liq bo'lmagan hujum trafikini ajratib olishlari kerak. Fastly PHP2Shell aniqlash naqshlarining ikkitasi asosan React2Shell faoliyatiga mos kelishini aniqladi.
Next-Action sarlavhasi bu so'rovlarni aniqlashga yordam berdi, —-wp2shell bilan boshlanadigan ko'p qismli chegaralar esa PHP2Shell emas, balki alohida WordPress kampaniyasini ko'rsatdi.
Chegara telemetriyasi urinishlarni ochib berishi mumkin, lekin bajarilishini ishonchli tarzda tasdiqlay olmaydi. Tergovchilar shubhali so'rovlarni PHP-FPM xatolari, Apache ishchi jarayonlarining ishdan chiqishi va PHP jarayonlaridan kutilmagan tashqi ulanishlar bilan bog'lashlari kerak.
Chegara satrlari foydali ov yo'llarini taqdim etadi, lekin tez o'zgaradigan User-Agent qiymatlari va umumiy proksi infratuzilmasi oddiy imzolar va IP blok ro'yxatlarini ishonchsiz qiladi.
Administratorlar PHP 8.2.35, 8.3.36, 8.4.27 yoki 8.5.12 ga yangilashlari, yoki o'z tarqatuvchisining tuzatilgan paketini o'rnatishlari kerak. Eski tarmoqlar tasdiqlangan orqaga moslashtirish yoki migratsiyani talab qiladi.
WAF himoyalari vaqtinchalik qoplamani ta'minlashi mumkin, lekin zaif so'rovni qayta ishlash ilova kodi bajarilishidan oldin sodir bo'lganligi sababli, ish vaqti tuzatish muhimligicha qoladi.
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign.
Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. However, those figures include defensive scanners and do not establish successful server compromises.
The activity targets CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, which carry CVSS scores of 9.2.
Both vulnerabilities affect the PHP engine and can enable unauthenticated remote code execution under specific conditions.
Because the weaknesses sit beneath application code, updating a content management system alone does not remediate the underlying exposure.
By release time, over 100 source IP addresses had deployed tooling using more than two dozen names, including an exploit kit advertising a CVE identifier in its User-Agent.
The most widespread kit sent POST requests to /index.php or /, used the User-Agent php2shell-109618, and supplied a multipart boundary of B7kQpoc618.
Requests targeted raw IP addresses rather than hostnames, typically hitting each host once or twice.
That pattern indicates opportunistic address-space scanning rather than targeting of named organizations.
Fastly identified more than ten candidate exploit kits through fixed or patterned multipart boundaries, with five linked directly to PHP2Shell by name, headers, or behavior.
Approximately one-third of the recorded traffic identified itself as defensive checking, although such labels cannot independently prove authorization.
CVE-2026-109618 involves an out-of-memory condition that interrupts initialization of internal request data, leaving cleanup routines handling inconsistent state.
The argument passed to zif_system is the command from the fake zend_string. The command executes with the privileges of the web server user (typically www-data).
Flowchart of exploitation (Source : Akatsuki Legion).
According to Akatsuki Legion technical analysis, the first PHP2Shell-named scanner appeared at 03:59 UTC on October 21, more than nine hours before the scheduled security release.
CVE-2026-109619 allows internal state to survive beyond the memory backing it, potentially exposing a subsequent request handled by the same worker to corrupted data.
These conditions distinguish PHP2Shell from vulnerabilities reliably triggered through a universal payload. Sansec’s updated assessment found that public proof-of-concept scripts did not work against default PHP installations.
By filtering out the known patched releases, the query successfully mapped out a persistent baseline of vulnerable infrastructure, recording 274 separate events across the timeline.
274 events in 30 days (Source : Akatsuki Legion).
Many required additional application weaknesses, including local file inclusion, or artificially vulnerable test environments. Consequently, widespread scanning should not be equated with widespread successful exploitation.
Recorded Future similarly warned that public repositories advertising exploit capabilities do not establish functional exploitation.
Some tools rely on invalidated theories, reinforcing the need to separate working attack chains from opportunistic probes and misleading demonstrations.
Defenders must also exclude unrelated attack traffic. Fastly found that two circulating PHP2Shell detection patterns overwhelmingly matched React2Shell activity instead.
The Next-Action header helped identify those requests, while multipart boundaries beginning —-wp2shell indicated a separate WordPress campaign rather than PHP2Shell.
Edge telemetry can reveal attempts but cannot reliably confirm execution. Investigators should correlate suspicious requests with PHP-FPM errors, Apache worker crashes, and unexpected outbound connections from PHP processes.
Boundary strings provide useful hunting leads, but rapidly changing User-Agent values and shared proxy infrastructure make simplistic signatures and IP blocklists unreliable.
Administrators should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or install their distributor’s patched package. Older branches require verified backports or migration.
WAF protections can provide temporary coverage, but runtime patching remains essential because vulnerable request processing occurs before application code executes.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.