Ikki muhim RCE zaifligi (CVE-2026-109618 va CVE-2026-109619), umumiy nom bilan PHP2Shell deb kuzatilgan, haqiqiy muhitda muvaffaqiyatli ekspluatatsiya qilindi.
Zararli faoliyat Perplexity kompaniyasining aniqlash va javob berish rahbari Adel Karimi tomonidan qayd etildi; uning honeypotlari Apache mod_php o'rnatmasi bilan ishlaydigan PHP 8.4.26 versiyasiga qarshi tasdiqlangan masofaviy kod bajarilishi (remote code execution) dalillarini yozib oldi.
"Bu endi shunchaki avariya emas, balki foydali xotira ma'lumotlarini ochib beradigan haqiqiy RCE. Javob 800 KiB dekodlangan cookie to'plamini yetkazdi, va bu to'plamdan ommaviy ekspluatning ofsetlari yordamida olingan funksiya manzili keyingi bajarish yuklamasida paydo bo'ladi," deb Karimi ma'lum qildi.
"Mijoz to'liq javobni tasdiqladi; keyin shell buyrug'i bajarish so'rovining oxirgi yozib olingan baytidan taxminan 1,6 ms keyin ishga tushdi."
Karimining topilmalari Expel tahdid tadqiqotchisi Marcus Hutchins tomonidan ham tasdiqlandi; u PHP2Shell ekspluatatsiyasi haqidagi bir qator muvaffaqiyatli hisobotlarni kuzatib kelmoqda.
"Bu hozirgacha ko'rgan eng yuqori sifatli haqiqiy muhitda php2shell ekspluatatsiyasi tasdig'i. Apache mod_php o'rnatmasi bilan ishlaydigan PHP 8.4.26 versiyasiga qarshi muvaffaqiyatli ekspluatatsiya urinishining chuqur texnik tahlili," dedi Hutchins.
PHP xavfsizlik jamoasi PHP2Shell kamchiliklarini chorshanba, 21-oktabr kuni tuzatdi — bu ma'murlarni xavfsizlik yangilanishlari tayyor bo'lishi bilan o'rnatishga tayyorlanishni so'raganidan bir kun keyin.
PHP2Shell xavfsizlik kamchiliklari (shu jumladan CVE IDlari va ayrim muhim infratuzilma provayderlariga taqdim etilgan yumshatish tavsiyalari) haqida ma'lumotlar onlayn tarqaldi va ba'zi isbot-konsept (PoC) ekspluatlar patchlar chiqarilishidan oldin e'lon qilindi, ammo PHP xavfsizlik jamoasi ularning hech biri ishlamaganini aytdi.
Bundan tashqari, bir nechta kiberxavfsizlik kompaniyalari (shu jumladan Cloudflare, Hadrian, watchTowr, Previdian va Patchstack) ommaviy e'lon qilinishidan oldin ekspluatatsiya urinishlarini aniqladi, lekin ularning barchasini muvaffaqiyatsiz deb belgiladi.
Amazon Threat Intelligence tadqiqotchilari ham xavfsizlik patchlari chiqarilishidan to'rt kun oldin hujumchilar PHP2Shell zaifliklarini nishonga olganini aniqladi. Biroq, Karimi topilmalari paydo bo'lguncha, zararli faoliyat "skanerlash, barmoq izini aniqlash va ishlamaydigan ekspluatlardan foydalanish bilan cheklangan, ma'lum buzilishlar yo'q edi," deb Dataminrning Threat Research and Cyber Engineering (TRACE) jamoasi ma'lum qildi.
Juma kuni PHP xavfsizlik jamoasi yangi RCE zaifligi (CVE-2026-115560 deb kuzatilgan) uchun yumshatish choralarini ham e'lon qildi; bu zaiflikning hali patchi yo'q va faqat "konfiguratsiya va ilova kodining g'ayrioddiy kombinatsiyasi" bilan tizimlarga hujum qilganda ekspluatatsiya qilinishi mumkin.
Xavfsizlik patchi chiqarilguncha, PHP ishlab chiquvchilari ma'murlarga session.upload_progress.enabled=0 ni o'rnatishni tavsiya qildi, bu PHP2Shell xavfsizlik yangilanishlari patchlari chiqarilishidan oldin ham tavsiya etilgan yumshatish chorasi.
PHP (Hypertext Preprocessor) — bu Internetdagi barcha veb-saytlarning taxminan 70% tomonidan ishlatiladigan veb-ishlab chiqish tili; VirusTotalning so'nggi baholariga ko'ra, 5,1 milliondan ortiq PHP xostlari onlayn ochiq va taxminan 3,8 millioni kamida bitta port bilan hujumlarga ochiq.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha mudofaa texnikasini texnika bo'yicha o'lchaydi.
Hisobotni oling
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.
"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.
"The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte."
Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.
The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after asking admins to prepare to install the security updates as soon as they became available.
While details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online and some proof-of-concept (PoC) exploits were published before the patches went live, the PHP security team said that none were functional.
Additionally, multiple cybersecurity companies (including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack) detected exploitation attempts before public disclosure, but flagged them all as unsuccessful.
Security researchers at Amazon Threat Intelligence also spotted attackers targeting the PHP2Shell vulnerabilities four days before security patches were released. However, until Karimi's findings, the malicious activity was "limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises," according to Dataminr's Threat Research and Cyber Engineering (TRACE) team.
On Friday, the PHP security team also shared mitigation measures for a new RCE vulnerability (tracked as CVE-2026-115560) that has no patch and can only be exploited when targeting systems "with an unusual combination of configuration and application code."
Until a security patch is released, the PHP devs advised admins to set session.upload_progress.enabled=0 to block potential attacks, a mitigation already recommended before patches for the PHP2Shell security updates were released.
PHP (Hypertext Preprocessor) is a web development language used by roughly 70% of all websites on the Internet, with more than 5.1 million PHP hosts exposed online and roughly 3.8 million with at least one port open to attacks, according to recent VirusTotal estimates.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report