2026-yil 17-oktabrda aniqlangan ekspluatatsiya urinishlari ikki muhim PHP zaifligiga qaratilgan bo'lib, bu ularning ommaviy e'lon qilinishi va xavfsizlik yangilanishlari chiqarilishidan to'rt kun oldin sodir bo'lgan.
CVE-2026-109618 va CVE-2026-109619 sifatida kuzatilgan bu zaifliklar birgalikda PHP2Shell deb ataladi va zaif veb-serverlarda autentifikatsiyasiz masofaviy kod bajarilishini ta'minlashi mumkin. Ikkalasi ham CVSS v4.0 bo'yicha 9.2 ballga ega.
Eng erta urinish Amazon'ning MadPot honeypot tarmog'iga 103.216.220.92 manzilidan yetib kelgan; bu manzil tijorat anonimlashtirish infratuzilmasi bilan bog'liq.
Amazon baholashicha, embargo qilingan zaiflikni anonimlashtirilgan infratuzilma orqali nishonga olish tahdid aktori faoliyatini ko'rsatadi.
Biroq, tergovchilar hujumchi ekspluatatsiya ma'lumotini e'lon qilinishidan oldin qanday olganini aniqlay olmagan.
Amazon e'loniga ko'ra, isbot-konsept ekspluatatsiyalari 2026-yil 21-oktabrda taxminan 02:00 UTC atrofida paydo bo'lgan, bu 14:00 UTC'dagi embargo bekor qilinishidan taxminan 12 soat oldin.
02:00 va 08:00 UTC oralig'ida MadPot anonimlashtirilgan infratuzilmadan qo'shimcha urinishlarni qayd etgan. Yuklamalar va infratuzilma farqlari yagona muvofiqlashtirilgan kampaniya emas, balki bir nechta aktorlar borligini ko'rsatgan.
Amazon texnik tahlil davom etayotganini va kuzatilgan urinishlar haqiqiy tizimlarga muvaffaqiyatli bo'lganligi tasdiqlanmaganini ogohlantirgan.
E'lon qilinishidan so'ng, bir necha soat ichida qo'shimcha ekspluatatsiya kodi paydo bo'lgan va deyarli darhol uning sensorlariga yo'naltirilgan. Kompaniya keyinchalik PHP2Shell'ni yovvoyi tabiatda keng tarqalgan deb ta'riflagan.
CVE-2026-109618 xotira tugashi bilan bog'liq ishlov berish bilan bog'liq. Xotira tugashi ichki so'rov ma'lumotlarini ishga tushirishni to'xtatganda, keyingi tozalash qisman ishga tushirilgan ma'lumotlarni haqiqiy deb qabul qilishi mumkin, bu esa hujumchilar masofaviy kod bajarish uchun foydalanishi mumkin bo'lgan xotira buzilishi holatini yaratadi.
CVE-2026-109619 eskirgan global holat va foydalanishdan keyin ozod qilish (use-after-free) xatti-harakatini o'z ichiga oladi. Bir so'rovdan saqlanib qolgan holat ozod qilingan xotiraga ishora qilishi mumkin, bu esa xuddi shu ishchi tomonidan qayta ishlangan keyingi so'rovga yaroqsiz ma'lumotlarga kirish imkonini beradi.
PHP shuningdek, bu zaiflikning tasdiqlangan ta'siri sifatida xotira ochilishi (memory disclosure) ni ham aniqlagan.
Ta'sir individual ilovalar bilan cheklanmaydi, chunki kamchiliklar PHP'ning o'zida joylashgan. Ta'sirlangan joylashtirish modellari PHP-FPM, Apache mod_php, php-cgi, FrankenPHP va LiteSpeed'ni o'z ichiga oladi.
PHP mod_php'ni ayniqsa zaif deb hisoblaydi, chunki namoyish etilgan ekspluatatsiya ilova kodi bajarilishidan oldin sodir bo'lishi mumkin, bu esa ilova darajasidagi autentifikatsiyani ushbu hujum yo'liga qarshi yetarli himoya qilmaydi.
Tuzatilgan versiyalar: PHP 8.5.12, 8.4.27, 8.3.36 va 8.2.35. Tarqatish paketlaridan foydalanadigan administratorlar tegishli tuzatilgan qurilmalar uchun sotuvchi maslahatlarini tekshirishlari kerak.
Qo'llab-quvvatlanmaydigan PHP 7.4 dan 8.1 gacha minimal manba orqaga moslashtirishlar (backports) mavjud, ammo bu tarmoqlar tuzatishlar uchun rasmiy reliz olmaydi.
Amazon yangilash har ikkala zaiflik uchun yagona to'liq tuzatish ekanligini ta'kidlaydi; konfiguratsiya o'zgarishlari birgalikdagi ta'sirni to'liq bartaraf eta olmaydi.
Ko'p qismli fayl yuklashlarini (multipart file uploads) vaqtincha bloklash ta'sirni kamaytirishi mumkin, ammo tashkilotlar ushbu cheklovni joriy etishdan oldin ilova funksionalligini baholashlari kerak.
Tergovlar maslahat sanasidan emas, balki 2026-yil 17-oktabrdan kechikmasdan boshlanishi kerak.
Himoyachilar yuklangan forma ma'lumotlarida PHPSESSIONUPLOAD_PROGRESS ni o'z ichiga olgan POST so'rovlarini tekshirishlari, veb-server jurnallarini ko'rib chiqishlari va ilova serverlarida kutilmagan jarayon bajarilishi yoki fayl o'zgarishlarini tekshirishlari kerak.
Amazon e'lon qilgan indikatorlar umumiy anonimlashtirish infratuzilmasini o'z ichiga oladi, shuning uchun mos keladigan manzillar avtomatik atributsiya yoki farqlanmagan bloklash emas, balki tergov talab qiladi.
Kompaniya shuningdek, zaiflikka xos imzolar mavjud bo'lishidan oldin ham foydali bo'lib qoladigan xatti-harakatga asoslangan aniqlashlarni tavsiya qiladi.
Ushbu hodisa Amazon'ning muhim internetga yo'naltirilgan zaifliklar soatlarda o'lchanadigan yumshatish muddatlarini talab qilishi haqidagi ogohlantirishini mustahkamlaydi.
Uning baholashi ekspluatatsiya ishlab chiqish oynalarining qisqarishini AI yordamidagi tahlil bilan bog'laydi, garchi bu e'lon qilinishidan oldingi hujumlarni AI yaratganini isbotlamasa ham.
Komprometatsiya Indikatorlari
IP Manzili Kuzatilgan Sana 103.216.220.92 10/17/2026 31.223.184.166 10/21/2026 37.19.200.5 10/21/2026 134.209.159.64 10/21/2026
Eslatma: IP manzillari va domenlar tasodifiy hal qilish yoki giperhavola yaratishning oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.
The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates.
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2.
The earliest attempt reached Amazon’s MadPot honeypot network from 103.216.220.92, an address associated with commercial anonymization infrastructure.
Amazon assessed that targeting an embargoed vulnerability through anonymized infrastructure suggested threat actor activity.
However, investigators have not established how the attacker obtained exploit information before disclosure.
According to Amazon’s disclosure, proof-of-concept exploits appeared around 02:00 UTC on October 21, approximately 12 hours before the 14:00 UTC embargo lift.
Between 02:00 and 08:00 UTC, MadPot recorded additional attempts from anonymized infrastructure. Differences in payloads and infrastructure suggested multiple actors rather than a single coordinated campaign.
Amazon cautioned that technical analysis is ongoing and that the observed attempts were not confirmed to have succeeded against real-world systems.
After disclosure, additional exploit code appeared within hours and was almost immediately directed at its sensors. The company subsequently described PHP2Shell as broadly exploited in the wild.
CVE-2026-109618 concerns out-of-memory handling. When memory exhaustion interrupts initialization of internal request data, subsequent cleanup can treat partially initialized data as valid, creating a memory-corruption condition that attackers may exploit for remote code execution.
CVE-2026-109619 involves stale global state and use-after-free behavior. State retained from one request can reference freed memory, allowing a subsequent request processed by the same worker to access invalid data.
PHP also identifies memory disclosure as a confirmed impact of this vulnerability.
The exposure extends beyond individual applications because the defects reside in PHP itself. Affected deployment models include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
PHP considers mod_php particularly exposed because demonstrated exploitation can occur before application code executes, making application-level authentication insufficient protection against that attack path.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators using distribution packages should consult vendor advisories for corresponding patched builds.
Minimal source backports exist for unsupported PHP 7.4 through 8.1, but these branches receive no official release for the fixes.
Amazon states that upgrading is the only complete remediation for both vulnerabilities; configuration changes cannot fully resolve the combined exposure.
Temporarily blocking multipart file uploads may reduce exposure, but organizations must assess application functionality before deploying that restriction.
Investigations should begin no later than October 17, rather than the advisory date.
Defenders should examine POST requests containing PHPSESSIONUPLOAD_PROGRESS in uploaded form data, review web server logs, and investigate unexpected process execution or file modifications on application servers.
Amazon’s published indicators include shared anonymization infrastructure, so matching addresses warrant investigation rather than automatic attribution or indiscriminate blocking.
The company also recommends behavior-based detections that remain useful before vulnerability-specific signatures become available.
The incident reinforces Amazon’s warning that critical internet-facing vulnerabilities require mitigation timelines measured in hours.
Its assessment links shrinking exploit-development windows to AI-assisted analysis, although it does not establish that AI produced the observed pre-disclosure attacks.
Indicators of Compromise
IP AddressObserved Date 103.216.220.92 10/17/2026 31.223.184.166 10/21/2026 37.19.200.5 10/21/2026 134.209.159.64 10/21/2026
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.