PHP ikkita PHP2Shell nomli muhim darajadagi zaifliklar uchun tuzatishlar e'lon qildi, ular hujumchilarga autentifikatsiyasiz masofaviy kod bajarish (RCE) imkoniyatini berishi mumkin edi.
Muammolar CVE-2026-109618 (xotira tugashi (OOM) buzilishi) va CVE-2026-109619 (eskirgan global holat) sifatida kuzatiladi va CVSS bahosi 9.2. Ikkalasi uchun ham Apache'da mod_php bilan RCE tasdiqlangan.
“Ikkala muammo ham PHP'ning deyarli har bir so'rov tegadigan qismlarida joylashgan: xotira boshqaruvi va xatoliklarni qayta ishlash. Ularning PHP'dagi markaziy o'rni ikkala zaiflikni jiddiy qildi, shuningdek, tuzatishni ham juda qiyinlashtirdi,” deb aytadi PHP Foundation.
Ikkalasi uchun tuzatishlar PHP 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalariga kiritildi. PHP 7.4, PHP 8.0 va PHP 8.1 uchun minimal manba orqaga qaytarishlar ham e'lon qilindi.
Tuzatishlar kelishidan oldin, ammo, ikkita xavfsizlik nuqsonini nishonga olgan isbot-konsepsiya (PoC) ekspluatatsiyalari tarqala boshladi.
Oldindan hujum yuzasini boshqarish firmasi WatchTowr aytishicha, tuzatishlar chiqqan paytda sensorlarida birinchi yovvoyi ekspluatatsiya urinishlarini ko'rgan, ammo muvaffaqiyatli urinishlarni kuzatmagan.Reklama. O'qishni davom ettirish uchun pastga aylantiring.
“Bugungacha hech kim muvaffaqiyatga erishmagan bo'lsa-da, biz bu uzoq davom etmasligini kutmaymiz,” dedi WatchTowr tahdid razvedkasi rahbari Jake Knott.
Bir nechta boshqa kompaniyalar ham ekspluatatsiya urinishlarini, shu jumladan tuzatishlar kelishidan oldin, kuzatganini xabar qildi.
“Biz hozir php2shell yovvoyi muhitda keng miqyosda ekspluatatsiya qilinayotganini ko'rmoqdamiz. Kuzatgan hujumlarimizning aksariyati PHP'ning sessiya yuklash-jarayon yo'lini suiiste'mol qiladi va biz tuzatish e'lon qilinishidan oldin va keyin ko'proq ekspluatatsiya yo'llari paydo bo'lishini kutamiz,” deb xabar qildi Hadrian tuzatishlar e'lon qilinishidan bir necha soat oldin.
Patchstack va Cloudflare ham kunning erta qismida ekspluatatsiya urinishlarini kuzatdi. Vega yovvoyi muhitda ommaviy PoC'dan foydalanilgan ekspluatatsiya urinishlarini ko'rdi.
PHP'ning saqlovchilari aytishicha, veb-so'rovlarni qayta ishlaydigan barcha PHP o'rnatishlari ekspluatatsiya xavfi ostida, “shu jumladan PHP-FPM, Apache'da mod_php, php-cgi, FrankenPHP va LiteSpeed”.
Tuzatish mumkin bo'lmagan hollarda, foydalanuvchilar “muayyan hujum yo'llariga ta'sirni kamaytiradigan, ammo o'rnatishni xavfsiz qilmaydigan” choralarni amalga oshirishi mumkin, deb aytadi PHP Foundation.
Ikkita PHP2Shell zaifligi 5.4 versiyasigacha deyarli barcha PHP nashrlariga ta'sir qiladi. Ular shuningdek, sezgir jarayon xotirasini o'qish uchun ham ekspluatatsiya qilinishi mumkin, bu esa ma'lumotlar, API kalitlari va boshqa sirlarni o'z ichiga olishi mumkin.
“Bu xakerlar uchun oltin kon. Ular haqiqiy veb-saytlarni egallab, saytning obro'sidan foydalanib, odamlarni aldash, ishonchli kanaldan zararli dasturlar tarqatish kabi ishlarni qilishlari mumkin; imkoniyatlar cheksiz,” dedi Malwarebytes global firibgarlik va AI tadqiqot rahbari Shahak Shalev.
Frontier AI PHP2Shell'ni ochdi
Wiz, OpenAI va Calif bilan birgalikda, avgust oyida zaifliklarni aniqladi va tuzatishlar ishlab chiqilib, ekotizim bo'ylab tarqatilguncha ularni yashirin saqladi.
“Bu topilmalar PHP'da, va ehtimol dasturiy ta'minot tarixida, aniqlangan eng jiddiy zaifliklar qatoriga kiradi. Asosiy nuqsonlar o'nlab yillar davomida mavjud bo'lgan, ammo ularning ekspluatatsiya qilinishini isbotlash inson tadqiqotchilari amaliy ravishda erisha oladigan chegarada, juda murakkab qadamlar zanjirini talab qildi,” deb ta'kidlaydi Wiz.
Calif tushuntirishicha, PHP'dagi dastlabki OOM zaifligi 2020-yilda aniqlangan, keyin esa 2024-yilda PHP auditida qayta topilgan. Biroq ekspluatatsiya isbotlanmagani uchun u tuzatilmagan. Chegaraviy AI modellari yordamida OOM zaifligi yaxshiroq tahlil qilinib, oxir-oqibat RCE'ga aylantirilgan.
OOM'dan RCE'ga o'tish muammosi Calif va OpenAI tomonidan 11-avgustda mustaqil ravishda xabar qilingan. Keyinchalik qo'shimcha hujum vektorlari OpenAI va Wiz tomonidan xabar qilingan.
“Calif, OpenAI va Wiz'dan kelgan hisobotlar OOM muammosining to'liq ta'sirini aniq ko'rsatdi va 11-avgustdan boshlab uni tuzatish PHP Foundation'ning xavfsizlik bo'yicha ishlaydigan barcha jamoasi uchun eng yuqori ustuvorlikka aylandi,” deb ta'kidlaydi PHP Foundation.
Wiz'ning PHP2Shell bo'yicha texnik chuqur tahlilini e'lon qilganiga ko'ra, CVE-2026-109618 va CVE-2026-109619 PHP'dagi to'rtta xotira xavfsizligi muammosini guruhlaydi, ammo barcha variantlarni qamrab olmaydi. Kuzatilgan va ehtimol kuzatilmagan variantlar ham mavjud, deb aytadi kiberxavfsizlik firmasi.
Xavfsizlik nuqsonlari PHP'ning o'zida bo'lgani uchun, ular CMS'dan qat'i nazar, dunyodagi veb-saytlarning 70 foiziga ta'sir qiladi.
“PHP vebning katta qismini quvvatlaydigan dasturlash tili bo'lib, WordPress, Drupal va MediaWiki, ya'ni Wikipedia ishlaydigan dasturiy ta'minotni quvvatlaydi. Uning asosiy dvigatelidagi zaiflik bu ekotizimdagi veb-saytlarga, hatto ularning o'z ilova kodi xavfsiz bo'lsa ham, ta'sir qilishi mumkin,” deb aytadi Wiz.
PHP Foundation'ga ko'ra, AI avvalgidagidan ko'proq PHP zaifliklarini yuzaga chiqarishga yordam berdi, 1-iyuldan beri 15 ta yangi CVE e'lon qilindi.
Erta sizib chiqish, erta ogohlantirish
PHP2Shell zaifliklari 22-oktabrda mas'uliyatli oshkor qilish uchun rejalashtirilgan edi, ammo ma'lumot 20-oktabrda onlayn sizib chiqdi va Foundation tuzatishlarni bir kun oldinroq e'lon qilishga qaror qildi.
Shuningdek, u muhim xatolar zudlik bilan e'tibor talab qilishi haqida oldindan ogohlantirish e'lon qildi. Bir nechta kiberxavfsizlik firmalari ham shunga o'xshash ogohlantirishlar e'lon qildi va zaifliklarning ekspluatatsiyasi darhol boshlanishi mumkinligini ta'kidladi.
Ishlaydigan PoC'ni ko'rsatadigan video oshkor qilish muddatidan oldin xato bilan e'lon qilindi. U ikkita zaiflik haqida qo'shimcha tafsilotlarni ochib berdi va “turli PoC'larning tezlashtirilgan rivojlanishiga hissa qo'shdi”.
PHP Foundation muhim infratuzilma tashkilotlariga taqdim etgan yumshatish tavsiyalari ham sizib chiqishi mumkin. Muvofiqlashtirilgan e'lon qilishdan olti soat oldin, Chainguard oldindan olgan tuzatishni o'z ichiga olgan tayyor tasvirlarni e'lon qildi.
“Har qanday hujumchi endi boshqa barcha PHP foydalanuvchilari hali e'lon qilishni kutayotgan paytda, tuzatishni ikkilik shaklda o'rganishi mumkin edi. Bu ko'plab tomonlarning muvofiqlashtirilgan oshkor qilish bo'yicha haftalar davom etgan ishini e'tiborsiz qoldirdi,” deb aytadi PHP Foundation.
Muvofiqlashtirilgan harakat doirasida, Cloudflare ommaviy oshkor qilishdan to'qqiz soat oldin PHP2Shell zaifliklariga qarshi himoyalarni joylashtirdi.
“Favqulodda PHP xavfsizlik yangilanishi jiddiy zaifliklar ommaviy bo'lganda tashkilotlar qanchalik tez javob berishga majbur bo'lishini ko'rsatadi. Tuzatish e'lon qilinishidan oldin, jamoalar allaqachon PHP qayerda ishlayotganini, zudlik bilan o'zgarishlarni kim tasdiqlashi mumkinligini va yangilanish ishlaganini qanday tasdiqlashlarini bilishlari kerak. Shuningdek, ular tuzatish o'rnatilishidan oldin hujumchilar ushbu tizimlarga yetib borgan-bormaganligini tekshirishlari kerak,” dedi SimSpace asoschisi va CTO Lee Rossey.
Bog'liq: Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
Bog'liq: Uch kun ichida ekspluatatsiya qilingan yuqori darajadagi zaifliklar, uchinchi chorakda ransomware hukmronligi: Rapid7
Bog'liq: Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq buziladigan kod yozadi
Bog'liq: AOMEI Backupper qisqa muddatli ta'minot zanjiri kampaniyasida buzildi
PHP has rolled out patches for two critical-severity vulnerabilities named PHP2Shell that could provide attackers with unauthenticated remote code execution (RCE).
The issues are tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-2026-109619 (stale global state) and have a CVSS score of 9.2. For both, RCE was confirmed on Apache with mod_php.
“Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix,” the PHP Foundation says.
Patches for both were included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 were also released.
Before the fixes arrived, however, proof-of-concept (PoC) exploits targeting the two security defects started circulating.
Preemptive attack surface management firm WatchTowr says it has seen the first in-the-wild exploitation attempts hitting its sensors around the same time the patches landed, but has not observed successful attempts.Advertisement. Scroll to continue reading.
“Whilst nobody has been successful to date, we don’t expect that will last long,” WatchTowr head of threat intelligence Jake Knott said.
Several other companies reported seeing exploitation attempts, including before the patches landed.
“We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP’s session upload-progress path, and we expect more exploit paths to appear before and after the fix ships,” Hadrian reported a few hours before the fixes were released.
Patchstack and Cloudflare also observed exploitation attempts earlier in the day. Vega saw exploit attempts in the wild that leveraged a public PoC.
According to PHP’s maintainers, all PHP installations that handle web requests are potentially at risk of exploitation, “including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed”.
Where patching is not possible, users can implement measures that “reduce exposure to specific attack paths but do not make an installation safe,” the PHP Foundation says.
The two PHP2Shell flaws affect nearly all PHP releases back to version 5.4. They can also be exploited to read sensitive process memory, which may contain credentials, API keys, and other secrets.
“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel; the opportunities are endless,” Malwarebytes global head of scam and AI research Shahak Shalev said.
Frontier AI uncovers PHP2Shell
Wiz, along with OpenAI and Calif, discovered the vulnerabilities in August and kept them contained until patches were developed and distributed across the ecosystem.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz notes.
Calif explains that an initial OOM flaw in PHP was discovered in 2020, and then rediscovered during a PHP audit in 2024. Because exploitation was not proven, however, it was not patched. Courtesy of frontier AI models, the OOM weakness could be better analyzed and eventually turned into RCE.
The OOM to RCE issue was independently reported by Calif and OpenAI on August 11. Additional attack vectors were later reported by OpenAI and Wiz.
“The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation’s team working on security,” the PHP Foundation notes.
According to Wiz, which has published a technical deep-dive on PHP2Shell, CVE-2026-109618 and CVE-2026-109619 group four memory-safety issues in PHP, but do not cover all variants. Both tracked and likely untracked variants exist, the cybersecurity outfit says.
Because the security defects are in PHP itself, they impact 70% of all websites in the world, independent of their CMS.
“PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure,” Wiz says.
According to the PHP Foundation, AI has helped surface more PHP vulnerabilities than before, with 15 new CVEs published since July 1.
Early leak, early warning
The PHP2Shell flaws were planned for responsible disclosure on October 22, but information leaked online on October 20, and the Foundation decided to push the patches one day earlier.
It also published a pre-announcement warning that the critical bugs require immediate attention. Several cybersecurity firms published similar warnings, noting that the flaws’ exploitation could begin immediately.
A video demonstrating a working PoC was mistakenly published ahead of the disclosure timeline. It revealed some additional details on the two weaknesses and “contributed to accelerated development of various PoCs”.
Mitigation advice the PHP Foundation provided to critical infrastructure organizations may have leaked as well. Six hours before the coordinated release, Chainguard published built images containing the fix it received in advance.
“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure,” the PHP Foundation says.
As part of the coordinated effort, Cloudflare deployed protections against the PHP2Shell vulnerabilities nine hours before public disclosure.
“The emergency PHP security update shows how quickly organizations can be forced to respond when serious vulnerabilities become public. Before a patch is released, teams should already know where PHP is running, who can authorize urgent changes, and how they will confirm the update worked. They also need to check whether attackers reached those systems before the fix was in place,” SimSpace co-founder and CTO Lee Rossey said.
Related: Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Related: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Related: Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Written By Ionut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Ahold Delhaize Restoring Services Disrupted by Cyberattack AI Platform Cairn Abused to Hack Over 100 Organizations Hackers Steal 1.8 Million Records From Nikkei Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Latest News
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
US Agencies Detail Incident Response Practices for Rogue AI Agents
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
One Compromised Login Exposed Millions of California Students’ Records
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)