AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) dushanba kuni yaqinda tuzatilgan PHP2Shell zaifliklarining faol ekspluatatsiyasini tasdiqladi va ularni Ma'lum ekspluatatsiya qilingan zaifliklar (KEV) katalogiga qo'shdi.
CVSS baholash tizimi bo'yicha 9.2 ball bilan baholangan ushbu PHP zaifliklari ta'sirlangan tizimlarda autentifikatsiyasiz masofaviy kod bajarishni osonlashtiradi:
- CVE-2026-109618 — Xotiradan tashqari buzilish zaifligi, bu autentifikatsiyasiz masofaviy kod bajarishga imkon beradi.
- CVE-2026-109619 — Ichki so'rov holatining eskirgan zaifligi, bu autentifikatsiyasiz masofaviy kod bajarishga imkon beradi.
Ushbu ikkita zaiflikning KEV katalogiga qo'shilishi Perplexity'dagi aniqlash va javob berish rahbari Adel Karimi 2026-yil 24-oktabrda honeypot tizimlariga qarshi masofaviy kod bajarishning muvaffaqiyatli holatlarini tasdiqlaganidan keyin sodir bo'ldi.
"Bu endi shunchaki avariya emas, balki foydalanish mumkin bo'lgan xotira ma'lumotlarini ochib beradigan haqiqiy RCE (masofaviy kod bajarish) ekanligi tasdiqlandi," dedi Karimi. "Javob 800 KiB dekodlangan cookie to'plamini yetkazib berdi va ushbu to'plamdan ommaviy eksploitning ofsetlari yordamida olingan funksiya manzili keyingi bajarish yuklamasida paydo bo'ladi."
"Dalillar ushbu zanjirni ataylab qulay yagona ishchi mod_php profilida ko'rsatadi; bu boshqa ishchi sonlari, PHP tuzilmalari yoki ilovalarda eksploit ishonchliligi o'lchovi emas."
Muammolar 2026-yil 21-oktabrda chiqarilgan PHP 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalarida tuzatilgan. Federal agentliklar 2026-yil 29-oktabrgacha zarur tuzatishlarni qo'llashlari kerak.
PHP (PHP: Hypertext Preprocessor) — internetdagi barcha veb-saytlarning taxminan 70% da ishlatiladigan server tomonidagi skriptlash tilidir. Censys tomonidan e'lon qilingan baholarga ko'ra, 32,51 milliondan ortiq PHP xizmati hali ham ta'sirlangan versiyada ishlamoqda.
Zaifliklarning jiddiyligi butun dunyo bo'ylab dasturiy ta'minot va xavfsizlik sotuvchilari hamda davlat agentliklari tomonidan ko'plab ogohlantirishlarga sabab bo'ldi, jumladan:
- ABB
- Arista Networks
- Belden
- Broadcom
- Canon
- Citrix
- Dell
- Dormakaba
- F5
- Hikvision
- HP
- HPE
- Hitachi Energy
- HMS Networks
- Huawei
- IBM
- Ivanti
- Johnson Controls
- Mitel
- Moxa
- NETGEAR
- Okta
- QNAP
- Rockwell Automation
- Ruckus Wireless
- Salesforce
- Schneider Electric
- Siemens (1), (2)
- SonicWall
- Splunk
- Synology
- Veeam
- Wibu-Systems
- WordPress
2026-yil 26-oktabr holatiga ko'ra, PHP Foundation shuningdek Brotli dekoder kutubxonasidagi chegaradan tashqari yozish zaifligi CVE-2026-111497 ni tuzatish uchun Windows tuzilmalarini (8.5.12-1, 8.4.27-1, 8.3.36-1 va 8.2.35-1) chiqardi. Bu zaiflik ham imtiyozlarni oshirish va autentifikatsiyasiz masofaviy kod bajarishga olib kelishi mumkin.
Broccoli2Shell, HTTP2Shell va Node2Shell nomlari bilan ham tanilgan ushbu zaiflik Brotli 1.0.3 dan 1.0.9 gacha, 1.1.0 va 1.2.0 versiyalariga ta'sir qiladi. U 1.0.10, 1.1.1 va 1.2.1 versiyalarida, shuningdek C kutubxonasini o'z ichiga olgan boshqa loyihalarda, jumladan Node.js, Bun, Envoy Proxy, Istio, .NET va Python'da tuzatilgan.
"PHP Windows tuzilmalarida zaif dekoder cURL kengaytmasi orqali, avtomatik HTTP javob dekompressiyasi yoqilganda erishish mumkin," dedi PHP Foundation. "Bu cURL'da sukut bo'yicha o'chirilgan, ammo ilovalar va HTTP mijoz kutubxonalari uni yoqishi mumkin."
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.
The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -
- CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
- CVE-2026-109619 - A stale internal request-state vulnerability that allows for unauthenticated remote code execution.
The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.
"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. "The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload."
"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications."
The issues have been addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released on October 21, 2026. Federal agencies have time until October 29, 2026, to apply the necessary fixes.
PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language used in roughly 70% of all websites on the internet. According to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version.
The severity of the vulnerabilities has prompted numerous advisories from software and security vendors and government agencies across the world, including -
- ABB
- Arista Networks
- Belden
- Broadcom
- Canon
- Citrix
- Dell
- Dormakaba
- F5
- Hikvision
- HP
- HPE
- Hitachi Energy
- HMS Networks
- Huawei
- IBM
- Ivanti
- Johnson Controls
- Mitel
- Moxa
- NETGEAR
- Okta
- QNAP
- Rockwell Automation
- Ruckus Wireless
- Salesforce
- Schneider Electric
- Siemens (1), (2)
- SonicWall
- Splunk
- Synology
- Veeam
- Wibu-Systems
- WordPress
As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution.
The vulnerability, also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
"In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled," the PHP Foundation said. "This is disabled by default in cURL, but applications and HTTP client libraries can enable it."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.