PHP PHP2Shell zaifliklari uchun shoshilinch tuzatishlarni e'lon qilganidan ikki kun o'tib, tahdid aktorlari bu kamchiliklardan Mirai botnetini tarqatish uchun foydalanishga urinishdi. Xavfsizlik firmasi shuningdek, asosiy xotira himoyasini chetlab o'tadigan eksploitni yaratdi, va ochiq qolgan hujumchi serveri maxsus vositalarni fosh qildi.
Shunga qaramay, hozirgacha yovvoyi muhitda muvaffaqiyatli buzilish tasdiqlanmagan.
Tahdid ko'plab tashkilotlarni ehtiyot chorasi sifatida tizimlarni o'chirishga undadi. Yevropadagi bir nechta hukumat, maktab va shifoxona veb-saytlari 21-oktabrda ishlamay qoldi, va Buyuk Britaniya hukumati 32 ta xizmatining ishlamayotganini va to'rttasi qisman ishlamayotganini, asosan tuzatishlar qo'llanilayotganda ehtiyot choralariga bog'liq deb aytdi.
PHP2Shell — bu CVE-2026-109618 va CVE-2026-109619 deb nomlangan, PHP dvigatelidagi ikkita muhim xato bo'lib, ular autentifikatsiyasiz masofaviy kod bajarish (RCE) uchun ekspluatatsiya qilinishi mumkin. Har birining CVSS v4.0 reytingi 9.2.
Wiz, OpenAI va Calif bu muammolarni avgust oyida topishdi. PHP ularni 21-oktabrda 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalari bilan, CVE identifikatorlari onlayn tarqalganidan so'ng, rejalashtirilganidan bir kun oldin tuzatdi.
Amazon 17-oktabrda birinchi ekspluatatsiya urinishini aniqladi, va hujum faolligi tuzatishlar chiqqanidan keyin keskin oshdi. Sotuvchilar, xavfsizlik firmalari va hukumat agentliklari shundan beri maslahatlar, aniqlash qoidalari va tuzatish yo'riqnomalarini e'lon qildi.
Mirai botneti ekspluatatsiya urinishlari bilan bog'liq
Sophos tahdid aktorlari PHP2Shell'dan Potassium'ni o'rnatish uchun foydalanishga urinishganini aytadi, bu esa Mirai botnetining varianti deb hisoblanadi. Tahlil qilingan urinish to'xtatildi, shuning uchun zararli dastur maqsad tizimiga yetib bormadi.
Sophos namunani yangilangan qurilish deb ta'riflaydi, u 2026-yil boshida birinchi marta aniqlangan Mirai'dan kelib chiqqan shtammning ko'proq funksionalligi bilan. U qo'shimcha zararli dasturlarni yuklab olishi va DDoS hujumlarini boshlashi mumkin.
Sophos'ning so'nggi tahlili kompaniyaning avvalgi yangilanishini tuzatdi, unda muvaffaqiyatli ekspluatatsiya haqida xabar berilgan edi.
Arctic Wolf ikkita Potassium binar faylini PHP2Shell yuklamalarini joylashtirgan serverlar bilan bog'ladi. Biroq, uning ma'lumotlari PHP2Shell so'rovlari zararli dastur yuklab olganini yoki ishga tushirganini ko'rsatmaydi.
Hunt.io kuzatgan PHP2Shell trafikini 2026-yil may oyidan beri faol bo'lgan, yaqinda tarqalish usullariga bu kamchiliklarni qo'shgan Mirai uslubidagi botnetga bog'ladi.
Sophos hujumchilarning bu xatolar bilan qiynalayotganiga ishonadi. "Yovvoyi muhitda muvaffaqiyatli eksploitlarning yo'qligi tahdid aktorlari ham qiynalayotganini ko'rsatadi," dedi u. Uning o'z dushman tadqiqot jamoasi ishlaydigan eksploit yaratish qiyin ekanligini, hatto AI yordamida ham, aniqladi.
Urinishlar, lekin tasdiqlangan buzilishlar yo'q
Boshqa firmalar ham shunga o'xshash manzarani chizishadi. Hunt.io ekspluatatsiya urinishlari va hujumchilar vositalarni tayyorlayotganini ko'rganini, lekin tasdiqlangan buzilish yo'qligini aytadi, va hech bir sotuvchi ham buni xabar qilmagan. Wordfence ham hujumlar davom etayotganini, lekin ma'lum buzilishlar yo'qligini aytadi.
Sansec, tuzatish chiqqanidan 15 daqiqa ichida ommaviy ekspluatatsiya bo'lishini bashorat qilgan edi, bu qarashini qayta ko'rib chiqdi. 22-oktabrdagi yangilanishida u hujumchilarga muvaffaqiyatga erishish uchun server haqida batafsil bilim va unda alohida sharoitlar kerakligini, va ommaviy mavjud eksploitlar standart sozlamalar bilan PHP o'rnatishlariga qarshi muvaffaqiyatsiz bo'lishini aytdi.
Eksploit ishlab chiqarish sozlamalarida ASLR'ni yengadi
Tadqiqotchilar xotira joylashuvini tasodifiylashtiradigan (ASLR) manzil maydoni tasodifiylashtirishni kod bajarishga erishish uchun muhim to'siq deb keltirishgan. VulnCheck uni chetlab o'tish yo'lini topganini aytadi.
Kompaniyaning CVE-2026-109618 uchun eksploit'i x86-64 tizimlarida ASLR yoqilgan va PHP xato ko'rsatishi o'chirilgan, ya'ni ishlab chiqarish uchun tavsiya etilgan sozlamada, kod bajarishga erishish uchun xotira sizib chiqishiga tayanadi. Eksploit VulnCheck'ning Initial Access Intelligence mijozlari uchun mavjud.
"Biz ishlab chiqarish konfiguratsiyalarida PHP'ning bir nechta versiyalarida RCE'ga erishadigan boshqa ommaviy yoki tijorat eksploit haqida bilmaymiz, garchi dushmanlar asta-sekin murakkabroq hujumlarni rivojlantirishi bilan bu o'zgarishini kutamiz," dedi VulnCheck.
Kompaniya shuningdek, GitHub'da yuzlab PoC omborlari paydo bo'lgan bo'lsa-da, ularning juda kam qismi haqiqiy eksploitlarni o'z ichiga olishini ta'kidladi.
Hujumchi serveri PHP2Shell vositalarini fosh qiladi
SOCRadar shunga o'xshash maqsadni ko'zlayotgan hujumchini aniqladi. U hujumchi nazoratidagi serverda PHP2Shell vositalarini topdi, uning ish fayllari ommaviy ko'rinadigan qilib qoldirilgan edi.
Fayllar Apache mod_php'dagi PHP 8.4.26 uchun eksploit zanjirini o'z ichiga olgan, operator uni laboratoriyada sinovdan o'tkazgan va "bir marta bosish" eksploit sifatida reklama qilgan. Hamroh skriptlar haqiqiy veb-saytlar eksploit talab qiladigan konfiguratsiyaga ega yoki yo'qligini tekshirgan.
Bu konfiguratsiya kam uchraydi. SOCRadar ma'lumotlariga ko'ra, zanjir faqat qattiqlashtirilgan ishlab chiqarish tizimlaridan ko'ra sinov tizimlariga o'xshash sozlangan serverlarda ishlaydi.
Operator AQSh, Buyuk Britaniya, Kanada, Fransiya, Finlandiya, Polsha va Xitoy kabi mamlakatlardagi taxminan 20 ta veb-saytni barmoq izini oldi va 11 tasini chuqurroq tekshirdi. Hech biri eksploit talablariga javob bermadi.
"Operator kuchli eksploit ishlab chiqish ko'nikmalarini namoyish etadi, lekin 2026-yil 22-oktabr holatiga ko'ra, biz tekshirilgan hech bir saytda shell kirishining dalilini ko'rmadik," dedi SOCRadar.
Hunt.io ham serverni tahlil qildi. U operator 10 ta hujum raundini o'tkazganini, maqsad ro'yxatini bulut provayderlari, umumiy hosting kompaniyalari va ISP'lar tomonidan joylashtirilgan 123 ta serverga kengaytirganini aniqladi. Taxminan 57 ta server PHP ishlatgan, 10 tasi so'rovlarni rad etgan, va hech biri muvaffaqiyatli ekspluatatsiya qilinmagan.
Tuzatish orqada qolmoqda
Qualys, 12 000 mijozidan anonimlashtirilgan ma'lumotlarni tahlil qilgan, faqat 199 000 PHP nusxasi e'lon qilinganidan 12 soat ichida tuzatilganini aytadi.
Kompaniyaga ko'ra, taxminan 110 million nusxa, ya'ni 71%, 5.4 dan 8.1 gacha bo'lgan PHP versiyalarini ishlatadi, ular hayot tsikli tugagan va ko'pchiligi hech qachon sotuvchi tuzatishini olmaydi. Yana 44 million nusxa tuzatishlar mavjud bo'lgan, lekin qo'llanilmagan qo'llab-quvvatlanadigan PHP tarmoqlarini ishlatadi.
23-oktabr ertalab holatiga ko'ra, CISA hali hech bir zaiflikni Ma'lum Ekspluatatsiya Qilingan Zaifliklar (KEV) katalogiga qo'shmagan.
Censys PHP2Shell uchun tuzatish jarayonini real vaqtda kuzatib bormoqda, u internetga ochiq PHP xizmatlarining qancha qismi hali zaif versiyani ishlatayotganini ko'rsatadigan ommaviy panel orqali.
Bog'liq: Hujumchilar To'rt Oy Ichida Uchinchi VeloCloud Orchestrator Zero-Day'ni Ekspluatatsiya Qilmoqda
Bog'liq: Oracle 2026-yil Oktyabr CPU bilan 1 200 dan ortiq zaiflikni tuzatdi
Yozgan: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta boshqaruvchi muharrir. U jurnalistika karerasini 2011-yilda boshlashdan oldin o'rta maktab IT o'qituvchisi bo'lib ishlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va elektr muhandisligida kompyuter texnikasi bo'yicha magistr darajasiga ega.
Two days after PHP rolled out emergency fixes for the PHP2Shell vulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom tooling.
Even so, no successful in-the-wild compromise has been confirmed so far.
The threat has prompted many organizations to take systems offline as a precaution. Several government, school and hospital websites in Europe went dark on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly due to precautionary measures taken while patches were applied.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution. Each has a CVSS v4.0 score of 9.2.
Wiz, OpenAI and Calif found the issues in August. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day earlier than planned, after the CVE identifiers leaked online.
Amazon spotted the first exploitation attempt on October 17, and attack activity surged once the fixes went out. Vendors, security firms and government agencies have since issued advisories, detection rules and patching guidance.Advertisement. Scroll to continue reading.
Mirai botnet linked to exploitation attempts
Sophos says threat actors have tried to leverage PHP2Shell to install Potassium, which it believes is a variant of the Mirai botnet. The attempt it analyzed was stopped, so the malware never reached the targeted system.
Sophos describes the sample as an updated build, with more functionality, of a Mirai-derived strain first identified in early 2026. It can download additional malware and launch DDoS attacks.
Sophos’s latest analysis corrected an earlier update from the company that reported a successful exploitation.
Arctic Wolf connected two Potassium binaries to the servers hosting PHP2Shell payloads. However, it said its data does not show the PHP2Shell requests fetching or running the malware.
Hunt.io attributed the PHP2Shell traffic it observed to an established Mirai-style botnet, active since at least May 2026, that recently added the flaws to the methods it uses to spread.
Sophos believes attackers are having a hard time with the bugs. “The lack of successful exploits in the wild suggests threat actors are also struggling,” it said. Its own adversary research team has found that building a working exploit is difficult, even with help from AI.
Attempts, but no confirmed breaches
Other firms paint a similar picture. Hunt.io says it has seen exploitation attempts and attackers preparing tooling, but no confirmed compromise, and no vendor has reported one either. Wordfence also says attacks are continuing without any known compromises.
Sansec, which had predicted mass exploitation within 15 minutes of the patch release, has revised that view. In an October 22 update, it said attackers need detailed knowledge of a server and particular conditions on it to succeed, and that the publicly available exploits fail against PHP installations with default settings.
Exploit defeats ASLR in production setups
Researchers have cited address space layout randomization (ASLR), which randomizes where code and data are placed in memory, as a significant hurdle to achieving code execution. VulnCheck says it has found a way around it.
The company’s exploit for CVE-2026-109618 relies on a memory leak to reach code execution on x86-64 systems with ASLR enabled and PHP error display turned off, which is the recommended setup for production. The exploit is available to VulnCheck’s Initial Access Intelligence customers.
“We are not aware of any other public or commercial exploit that achieves RCE on multiple versions of PHP in production configurations, though we expect that to change as adversaries develop incrementally more sophisticated attacks,” VulnCheck said.
The company also noted that while hundreds of PoC repositories have appeared on GitHub, very few of them contain legitimate exploits.
Attacker server exposes PHP2Shell toolkit
SOCRadar uncovered an attacker pursuing a similar goal. It discovered PHP2Shell tooling on an attacker-controlled server whose working files were left publicly browsable.
The files included an exploit chain for PHP 8.4.26 on Apache mod_php, which the operator had tested in a lab and billed as a “one-click” exploit. Companion scripts checked whether real websites had the configuration the exploit requires.
That configuration is uncommon. According to SOCRadar, the chain only works on servers set up more like test systems than hardened production ones.
The operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth. None met the exploit’s requirements.
“The operator shows strong exploit development skills, but as of October 22, 2026, we have seen no evidence of shell access on any screened site,” SOCRadar said.
Hunt.io also analyzed the server. It found that the operator ran 10 attack rounds, expanding the target list to 123 servers hosted by cloud providers, shared hosting companies and ISPs. Roughly 57 of the servers ran PHP, 10 rejected the requests, and none was successfully exploited.
Patching lags behind
Qualys, which analyzed anonymized data from 12,000 of its customers, says only 199,000 PHP instances were patched within 12 hours of disclosure.
According to the company, roughly 110 million instances, or 71%, run PHP versions 5.4 through 8.1, which are past end of life, and most of them will never receive a vendor patch. Another 44 million instances run supported PHP branches for which fixes exist but had not been applied.
As of the morning of October 23, CISA had not added either vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Censys is tracking patching progress for PHP2Shell in real time through a public dashboard that shows how many internet-facing PHP services still run a vulnerable version.
Related: Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
Related: Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Written By Eduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
Tech and Security Companies Respond to PHP2Shell Vulnerabilities Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Latest News
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months 11 Million Impacted by Capcom Data Breach Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’ LiteLLM Compromised in Fresh Supply Chain Attack Atlassian Patches 75 Flaws in Data Center and Server Products Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Hacker Conversations: Corey Thuen and the Evil Bit
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
PHP2Shell Exploitation Started Days Before Patches
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Cisco Patches 34 Vulnerabilities Across Multiple Products
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)