Tahdidchilar bir haftadan ortiq vaqtdan beri PHP2Shell zaifligiga ega serverlarga hujum qilmoqda, ammo hozirgacha faqat bir nechta muvaffaqiyatli buzilishlar tasdiqlangan.
Xitoy bilan bog'liq xakerlar guruhi Palo Alto Networks firewall'larini ildizdan buzgan hujumlarda PHP2Shell va Fragnesia yadro imtiyozlarini oshirish xatosini birlashtirgan holda ajralib turadi.
AI yordamida xakerlar ikkita alohida eksploitni birlashtirdilar: biri Palo Alto Networks'ning PAN-OS qurilmalaridagi PHP2Shell zaifliklari CVE-2026-109618 va CVE-2026-109619 ni maxsus nishonga olgan, ikkinchisi esa Fragnesia uchun ildiz imtiyozlari bilan vebshell'larni joylashtirish maqsadida ishlatilgan.
Dream kiberxavfsizlik tashkiloti ushbu kampaniyani shu hafta boshida e'lon qildi va yuzlab qurilma orasidan kamida 25 ta firewall buzilganini ta'kidladi. Palo Alto Networks keyinchalik bu natijalarni tasdiqladi.
"Dream Research hujumchilar PHP2Shell'ni Linux yadro imtiyozlarini oshirish zaifligi bilan birlashtirib, ildizga kirish huquqini qo'lga kiritgan kampaniyani xabar qildi. Unit 42 mustaqil ravishda o'sha hujumchining vositalarini tekshirdi va xabar qilingan natijalarni tasdiqladi," deb aytdi Palo Alto Networks.
Kompaniya PAN-OS 12.2, 12.1, 11.2, 11.1 va 10.2 versiyalarida PA-Series va VM-Series firewall'lari, shuningdek Panorama (virtual va M-Series) uchun PHP2Shell zaifliklarini tuzatuvchi yangilanishlarni chiqardi.
"Ushbu muammo ta'sir qilish uchun maxsus konfiguratsiya talab qilinmaydi. Palo Alto Networks'ning internetga ochiq boshqaruv interfeysi nishonga olingan holda faol ekspluatatsiya kuzatilgan," deb ta'kidlaydi kompaniya o'z maslahatida.
Palo Alto Networks aytishicha, boshqaruv interfeysi odatda internetga ochiq emas va mijozlarga darhol unga kirishni cheklash va mavjud tuzatishlarni qo'llashni tavsiya qiladi.
"Bizning global o'rnatilgan bazamizning faqat kichik qismi (taxminan .02%) internetga ochiq boshqaruv interfeyslariga ega bo'lib, ta'sirlangan. Ushbu mijozlarning har biri jamoalarimiz tomonidan alohida bog'lanib xabar berilgan. Biz tekshiruvni davom ettiramiz va zarur bo'lganda har qanday yangilanishlarni taqdim etamiz," deb qayd etadi Palo Alto Networks.
22,6 million ochiq PHP nusxalari
Kompaniyaga ko'ra, 29-oktabr holatiga ko'ra, uning telemetriyasi PHP2Shell xatolariga potentsial zaif bo'lishi mumkin bo'lgan 22,6 milliondan ortiq ochiq PHP nusxasini aniqlagan.
Bu ajablanarli emas, chunki PHP serverlar va kontentni boshqarish tizimlari, jumladan WordPress, Drupal, Joomla va boshqalar orasida keng qo'llaniladi.
Ommaviy PHP2Shell ekspluatatsiyasi ularga ham qaratilgan, ammo kamida WordPress haqida gap ketganda, asosan muvaffaqiyatsiz qolgan, deb aytadi veb-xavfsizlik firmasi Defiant.
28-oktabr holatiga ko'ra, u PHP2Shell ekspluatatsiyasi orqali buzilgan birorta WordPress saytini bilmaydi, garchi 2000 dan ortiq IP manzillaridan 77 000 dan ortiq tegishli so'rovlarni qayd etgan bo'lsa ham.
Biroq Defiant ta'kidlashicha, sinovlar eksploitlar ko'pincha nishonlangan serverlarda ishlash uchun moslashtirilishi kerakligini ko'rsatgan, bu ASLR, PHP tuzilishi, ishlaydigan kengaytmalar, xotira cheklovlari va serverning so'rovlarni qayta ishlashiga bog'liq.
"Hujumchilar hali ham o'z vositalarini o'zgartirmoqda. Muvaffaqiyatli hujum ularga saytingiz fayllari, ma'lumotlar bazasi va parollariga kirish huquqini berishi mumkin, shuning uchun PHP'ni yangilash muhim bo'lib qoladi," deb ogohlantirdi Defiant.
Bir nechta IP manzillar
Keng qamrovli PHP2Shell ekspluatatsiya urinishlariga qaramay, muvaffaqiyat juda kam tahdidchilarga tegishli bo'lgan.
Cato Networks ma'lumotlariga ko'ra, u bloklagan hujumlarning taxminan 96% CVE-2026-109618 ga qaratilgan va ularning 41% masofaviy kod bajarilishini (RCE) sinab ko'rgan, qolganlari esa skanerlash yoki yaroqsiz PoC urinishlari bo'lgan.
Urinishlar AQSh, Niderlandiya va Germaniyadagi bir nechta IP manzillaridan kelib chiqqan va isbot-konsepsiya (PoC) uslubidagi so'rovlarni takrorlagan. Ularning aksariyati buyruq bajarilishiga qaratilgan, keyin deserializatsiya urinishlari kelgan.
Cato ma'lumotlariga ko'ra, sog'liqni saqlash tashkilotlari eng ko'p nishonga olingan, keyin texnologiya va xavfsizlik xizmatlari, professional xizmatlar, avtomobilsozlik, ta'lim va notijorat, shuningdek ishlab chiqarish, qurilish va chakana savdo kelgan.
Biroq hujumlar maqsadli emas, balki tasodifiy ko'rinadi, chunki o'sha manba bir kunda sog'liqni saqlash, texnologiya va dasturiy ta'minot sohalaridagi tashkilotlarga so'rov yuborgan.
WatchTowr Germaniyadagi bitta IP manzildan muvaffaqiyatli PHP2Shell ekspluatatsiyasini kuzatganini aytadi, garchi urinishlar hajmi va yuklamalar xilma-xilligi katta bo'lsa ham.
"Har bir holatda u ekspluatatsiya muvaffaqiyatli bo'lganini isbotlash uchun oddiy 'curl' buyrug'ini bajaradi va shu yerda to'xtaydi, qo'shimcha post-ekspluatatsiya faoliyati yo'q," dedi WatchTowr tahdid razvedkasi rahbari Jake Knott.
"Yangi texnikalar, ixtirochi yuklamalar va yaxshiroq qurilma-maxsus eksploitlar yanada ishonchli eksploitlar ishlab chiqilayotganda tarqatilmoqda va biz maxsus chekka qurilmalarning yuqori maqsadli muvaffaqiyatli ekspluatatsiyasi haqida ommaviy xabarlar faqat o'sishda davom etishini ko'rishimiz mumkin," deb qo'shimcha qildi Knott.
Bog'liq: WordPress'dagi Yangi Zaiflik Hujumchilarning Nishonida
Bog'liq: Drupal Commerce Core Zaifligi Onlayn Do'konlarga Qarshi Ekspluatatsiya Qilinmoqda
Bog'liq: Maksimal Jiddiylikdagi GitLab Zaifligi Alpine Linux'ga Qarshi Ekspluatatsiya Qilinmoqda
Bog'liq: Adobe, Veeam, Juniper Networks Muhim Zaifliklarni Tuzatdi
Threat actors have been hammering servers vulnerable toPHP2Shellfor over a week, but only a few successful compromises have been confirmed to date.
Standing out are Palo Alto Networks firewalls, which have been rooted by a China-linked hacking group in attacks chaining PHP2Shell with the Fragnesia kernel privilege escalation bug.
Assisted by AI, the hackers chained two separate exploits: one specifically targeting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on Palo Alto Networks’ PAN-OS devices, and another one for Fragnesia to deploy webshells with root privileges.
Cybersecurity outfit Dream flagged the campaign earlier this week, noting that at least 25 firewalls out of a pool of hundreds were hacked. Palo Alto Networks has since confirmed the findings.
“Dream Research has reported a campaign in which attackers chained PHP2Shell with a Linux kernel privilege-escalation vulnerability to gain root access. Unit 42 has independently verified the same attacker’s tooling and confirmed the reported results,” Palo Alto Networks said.
The company has rolled out patches that resolve the PHP2Shell flaws in PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 for PA-Series and VM-Series firewalls, and for Panorama (virtual and M-Series).
“No special configuration is required to be affected by this issue. Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet,” the company notes in its advisory.
Palo Alto Networks says that by default the management interface is not exposed to the internet and urges customers to immediately restrict access to it and apply the available fixes.
“Only a small fraction of a percent (approximately .02%) of our global installed base has internet-facing management interfaces configured and was impacted. Each of these customers has been individually contacted by our teams. We will continue to investigate and provide any necessary updates as they become available,” Palo Alto Networks notes.
22.6 million exposed PHP instances
According to the company, as of October 29, its telemetry has identified over 22.6 million exposed PHP instances that are potentially vulnerable to the PHP2Shell bugs.
That is not surprising, given that PHP is widely used across servers and content management systems, including WordPress, Drupal, Joomla, and many others.
The mass PHP2Shell exploitation has been targeting those as well, but remained largely unsuccessful, at least when it comes to WordPress, web security firm Defiant says.
As of October 28, it was not aware of any WordPress site being compromised via PHP2Shell exploitation, although it has recorded over 77,000 related requests from more than 2,000 IP addresses.
However, Defiant points out that testing has revealed the exploits often need to be adjusted to work on targeted servers, influenced by ASLR, PHP build, running extensions, memory limits, and the server’s request handling.
“Attackers are still changing their tools. A successful attack could give them access to your site’s files, database, and passwords, so updating PHP remains essential,” Defiant warned.
A handful of IPs
Despite the broad PHP2Shell exploitation attempts, success has been attributed to very few threat actors.
According to Cato Networks, roughly 96% of the attacks it has blocked targeted CVE-2026-109618, and 41% of them attempted remote code execution (RCE), while the remaining were scanning or invalid PoC attempts.
The attempts originated from a handful of IPs in the US, the Netherlands, and Germany, repeating proof-of-concept (PoC) style requests. Most of them focused on command execution, followed by deserialization attempts.
According to Cato, healthcare organizations were targeted the most, followed by technology and security services, professional services, automotive, education and non-profit, and manufacturing, construction, and retail.
The attacks, however, were not targeted, but appeared opportunistic, as the same source was seen sending requests to organizations in the healthcare, technology, and software sectors during the same day.
WatchTowr says it has observed successful PHP2Shell exploitation from a single IP address in Germany, despite the large volume of attempts and variety of payloads.
“In every case, it executes a simple ‘curl’ command to prove exploitation was successful, and stops there, with no additional post-exploitation activity,” WatchTowr head of threat intelligence Jake Knott said.
“New techniques, inventive payloads, and better appliance-specific exploits are being thrown around as more reliable exploits are worked on, and we’re likely to only see public reporting of highly targeted successful exploitation of specific edge appliances keep growing,” Knott added.
Related:Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related:Drupal Commerce Core Vulnerability Exploited Against Online Stores
Related:Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
