PHP yangi RCE zaifligi uchun yamoq yo'qligida yumshatish choralarini e'lon qildi
Muallif: Sergiu Gatlan
2026-yil 23-oktabr
11:38
0
PHP xavfsizlik jamoasi yangi masofaviy kod bajarish (remote code execution) zaifligi uchun yumshatish choralarini e'lon qildi. Bu zaiflik standart bo'lmagan konfiguratsiyali tizimlarga ta'sir qiladi va hozircha yamoq mavjud emas.
PHP — ochiq kodli veb-ishlab chiqish tili bo'lib, Internetdagi barcha veb-saytlarning deyarli 70% tomonidan ishlatiladi. VirusTotal ma'lumotlariga ko'ra, 5,1 milliondan ortiq PHP xostlari onlayn tarzda ochiq, va taxminan 3,8 millionida hujumlarga ochiq kamida bitta port mavjud.
Juma kungi maslahatga ko'ra, bu xavfsizlik zaifligi (CVE-2026-115560 sifatida kuzatiladi) faqat "konfiguratsiya va ilova kodining g'ayrioddiy kombinatsiyasi" bilan tizimlarga hujum qilishda ishlatilishi mumkin.
"Ilova o'z konfiguratsiyasida session.serializehandler ni phpbinary yoki phpserialize ga o'rnatishi, so'ngra iniset() yordamida uni php ga o'zgartirishi va keyin session_start() ni chaqirishi kerak. Shuningdek, sessiya yuklash jarayoni (session upload progress) hali ham yoqilgan bo'lishi kerak," deb tushuntirdi PHP jamoasi.
"Seriyalash ishlov beruvchini ish vaqti davomida o'zgartirmaydigan ilovalar bu funksiyani yoqilgan holda saqlab qolishi mumkin. Amalda bunday sozlama kam uchraydi, shuning uchun biz buni odatiy reliz siklida hal qilamiz va CVE-2026-115560 uchun to'liq maslahatni keyingi reliz bilan e'lon qilamiz."
Xavfsizlik yamog'i mavjud bo'lmaguncha, PHP ishlab chiquvchilari session.upload_progress.enabled=0 ni o'rnatishni tavsiya qildilar va qo'shib qo'ydilar: "Agar siz buni avvalroq qo'llagan bo'lsangiz, uni saqlab qoling — qo'shimcha harakat talab etilmaydi."
Bu yumshatish chorasi chorshanba kuni, PHP2Shell deb nomlangan boshqa ikkita muhim RCE zaifligi (CVE-2026-109618 va CVE-2026-109619) yamog'idan oldin qo'llanilishi kerak edi.
PHP2Shell zaifliklari endi hujumlarda nishonga olinmoqda
PHP xavfsizlik jamoasi PHP2Shell zaifliklarini yangilanishlar tayyor bo'lishi bilan o'rnatish uchun administratorlarni tayyorlanishga chaqirgandan bir kun o'tib yamadi.
Yamoqlar e'lon qilinishidan oldin ba'zi isbot-kod (PoC) nashr etilgan bo'lsa-da, PHP xavfsizlik jamoasi ularning hech biri ishlamayotganini aytdi.
Biroq, bir nechta kiberxavfsizlik kompaniyalari (jumladan Cloudflare, watchTowr, Previdian, Hadrian va Patchstack) ommaviy e'lon qilinishdan oldin muvaffaqiyatsiz ekspluatatsiya urinishlarini aniqladilar. Bu PHP2Shell xavfsizlik zaifliklari haqida ba'zi tafsilotlar (jumladan CVE IDlari va ba'zi muhim infratuzilma provayderlariga taqdim etilgan yumshatish maslahatlari) onlayn tarzda sizib chiqqanidan keyin sodir bo'ldi.
Amazon Threat Intelligence tadqiqotchilari ham hujumchilar PHP2Shell zaifliklarini chorshanba kuni xavfsizlik yamoqlari e'lon qilinishidan to'rt kun oldin nishonga olishni boshlaganini aytishdi.
"Haqiqiy yuklamalar va anonimlashtirish infratuzilmasidagi tanlovlar turlicha edi, bu bir nechta aktyorlar ekanligini ko'rsatadi. Texnik tahlil davom etmoqda va bu urinishlardan birortasi haqiqiy tizimlarda muvaffaqiyatli bo'lganmi yoki yo'qmi, aniq emas," dedi AWS bosh axborot xavfsizligi direktori CJ Moses.
"PHP2Shell endi yovvoyi tabiatda keng tarqalgan ekspluatatsiya urinishlarini ko'rmoqda," deb qo'shib qo'ydi u, garchi qancha hujum (agar bo'lsa) muvaffaqiyatli bo'lgani aniq bo'lmasa ham.
Dataminrning Threat Research and Cyber Engineering (TRACE) jamoasi payshanba kungi hisobotida "zaiflik e'lon qilinganidan beri kuzatilgan faoliyat skanerlash, barmoq izini aniqlash va ishlamaydigan ekspluatatsiyalardan foydalanish bilan cheklangan, ma'lum buzilishlar yo'q," deb aytdi, lekin "ishlaydigan PoC yoki muvaffaqiyatli ekspluatatsiya faoliyati paydo bo'lishi faqat vaqt masalasi" ekanligini ta'kidladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
The Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikaga texnika himoyani o'lchaydi.
Hisobotni oling
Tegishli maqolalar:
PHP muhim PHP2Shell zaifliklari uchun favqulodda yamoqlarni e'lon qildi
HPE sakkizta maksimal jiddiylikdagi RCE va autentifikatsiyani chetlab o'tish AOS zaifliklarini yamadi
GitLab yangi maksimal jiddiylikdagi kod bajarish zaifligi haqida ogohlantirdi
F5 muhim NGINX zaifliklari uchun reja tashqarisidagi yamoqlarni e'lon qildi
Xakerlar SiteGuard WAF zaifligidan foydalanib, administrator sifatida buyruqlarni bajarishmoqda
PHP shares mitigation for new RCE vulnerability with no patch
By Sergiu Gatlan
October 23, 2026
11:38 AM
0
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks.
According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code."
"An application must set session.serializehandler to phpbinary or phpserialize in its configuration and then switch it to php at runtime with iniset() before calling session_start(). Session upload progress must also still be enabled," the PHP team explained.
"Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."
Until a security patch is available, the PHP devs suggested setting session.upload_progress.enabled=0, adding that "If you applied it then, keep it in place and no further action is needed."
This mitigation should have already been applied on Wednesday, before patching two other critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
PHP2Shell flaws now targeted in attacks
The PHP security team patched the PHP2Shell vulnerabilities one day after urging admins to prepare to install the updates as soon as they became available.
While some proof-of-concept (PoC) code was published before the patches went live, the PHP security team said none were functional.
However, multiple cybersecurity companies (including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack) detected unsuccessful exploitation attempts before public disclosure, after some details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online.
Security researchers at Amazon Threat Intelligence also said that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released on Wednesday.
"The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems," said AWS chief information security officer CJ Moses.
"PHP2Shell is now seeing broad exploitation attempts in the wild," he added, though it's unclear how many attacks (if any) have succeeded.
Dataminr's Threat Research and Cyber Engineering (TRACE) team also said in a Thursday report that "observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises," but noted that "it remains only a matter of time for working POCs or successful exploitation activity to emerge."
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
PHP ships emergency patches for critical PHP2Shell flaws
HPE patches eight max severity RCE and auth bypass AOS flaws
GitLab warns of new max severity code execution vulnerability
F5 releases out-of-band patches for critical NGINX vulnerabilities
Hackers exploit SiteGuard WAF flaw to run commands as admins