AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) PHP2Shell nomi bilan umumiy kuzatiladigan ikkita muhim PHP zaifligini faol ishlatilayotgan xavfsizlik kamchiliklari katalogiga qo'shdi.
Imtiyozlarsiz tahdid aktorlari ikkita xavfsizlik muammosini (CVE-2026-109618 va CVE-2026-109619) yuqori murakkablikdagi hujumlarda ishlatib, yangilanmagan tizimlarda masofaviy kod bajarilishini (RCE) qo'lga kiritishlari mumkin.
PHP xavfsizlik jamoasi chorshanba, 21-oktabr kuni ikkita kamchilikni tuzatdi, bu xavfsizlik yangilanishlari mavjud bo'lishi bilanoq xavfsizlik jamoalarini ularni o'rnatishga chaqirganidan bir kun keyin.
PHP2Shell xavfsizlik kamchiliklari haqida tafsilotlar (jumladan, muhim infratuzilma provayderlari bilan baham ko'rilgan CVE identifikatorlari va yumshatish choralari) sizib chiqqan va ba'zi isbot-konsepsiya (PoC) ekspluatlari yamoqlar jonli bo'lishidan oldin onlayn nashr etilgan bo'lsa-da, PHP xavfsizlik jamoasi ularning hech biri ishlamaganini aytdi.
Bir nechta kiberxavfsizlik firmalari (jumladan, Cloudflare, Amazon, Hadrian, watchTowr, Previdian va Patchstack) ham ommaviy oshkor qilishdan oldin keng tarqalgan ekspluatatsiya urinishlarini aniqladi, lekin ularning barchasi ularni muvaffaqiyatsiz deb belgiladi.
Amazon Threat Intelligence xavfsizlik tadqiqotchilari ham hujumchilar PHP2Shell zaifliklarini xavfsizlik yamoqlari chiqarilishidan to'rt kun oldin nishonga olishni boshlaganini aytdi.
Federal agentliklarga payshanbagacha yamoq o'rnatish buyurildi
CISA dushanba kuni zaifliklarni o'zining Ma'lum Ishlatilayotgan Zaifliklar Katalogiga qo'shdi va Federal Fuqarolik Ijroiya Tarmog'i (FCEB) agentliklariga tizimlarini payshanbagacha xavfsiz qilishni buyurdi, bu Majburiy Operatsion Direktiv 26-04 bilan talab qilingan.
"Bunday turdagi zaifliklar zararli kiber aktorlar uchun tez-tez hujum vektori bo'lib, federal korxonaga jiddiy xavf tug'diradi," deb ogohlantirdi kiberxavfsizlik agentligi.
"BOD 26-04 faqat FCEB agentliklariga tatbiq etilsa-da, CISA barcha tashkilotlarni xavfga asoslangan zaifliklarni boshqarishni qabul qilishga va KEV Katalogidagi zaifliklarni tuzatishni ustuvor qilishga rag'batlantiradi."
CISA hali PHP2Shell hujumlari haqida qo'shimcha tafsilotlarni baham ko'rmagan bo'lsa-da, Perplexity aniqlash va javob berish rahbari Adel Karimi dam olish kunlari davomida ularning asalari PHP 8.4.26 ishlatayotgan Apache mod_php o'rnatilishiga qarshi masofaviy kod bajarilishini isbotlovchi dalillarni qayd etganidan so'ng, yovvoyi muhitda ekspluatatsiyani birinchi bo'lib tasdiqladi.
Juma kuni PHP xavfsizlik jamoasi ham yangi RCE kamchiligi (CVE-2026-115560) uchun yumshatish choralarini baham ko'rdi, bu yamoq yo'q va "konfiguratsiya va ilova kodining g'ayrioddiy kombinatsiyasi" bilan tizimlarni nishonga olishda ishlatilishi mumkin.
VirusTotal baholariga ko'ra, PHP barcha veb-saytlarning taxminan 70% ni quvvatlaydi, onlayn ochiq 5,1 milliondan ortiq PHP xostlari va kamida bitta port hujumlarga ochiq bo'lgan taxminan 3,8 million nusxalari mavjud.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.
Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.
The PHP security team patched the two flaws on Wednesday, October 21, one day after urging security teams to install the security updates as soon as they became available.
Although details on the PHP2Shell security flaws (including the CVE IDs and mitigation measures shared with critical infrastructure providers) leaked and some proof-of-concept (PoC) exploits were published online before patches went live, the PHP security team said that none were functional.
Multiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them as unsuccessful.
Amazon Threat Intelligence security researchers also said that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released.
Federal agencies ordered to patch by Thursday
CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Thursday, as mandated by Binding Operational Directive 26-04.
"These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise," the cybersecurity agency warned.
"While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."
While CISA has not yet shared further details about ongoing PHP2Shell attacks, Perplexity detection and response lead Adel Karimi first confirmed in-the-wild exploitation over the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
On Friday, the PHP security team also shared mitigation for a new RCE flaw (CVE-2026-115560) with no patch, exploitable when targeting systems "with an unusual combination of configuration and application code."
PHP powers roughly 70% of all websites, with more than 5.1 million PHP hosts exposed online and around 3.8 million instances with at least one port open to attacks, according to VirusTotal estimates.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report