Yangilanishda Palo Alto Networks Unit 42 avvalgi bahosini qaytarib olganini aytdi — ya'ni Yevropa davlat agentligiga qaratilgan hujumdan keyingi faoliyat PHP2Shell zaifliklarining ekspluatatsiyasini o'z ichiga olgan deb hisoblangan edi.
"Tadqiqotchilar ko'rgan narsa — bu zaif PHP ilovasi kontekstida Yevropadagi davlat agentligiga qarshi amalga oshirilgan hujum edi," deb aytdi kompaniya vakili The Hacker News'ga elektron pochta orqali. "Bu bizni o'sha zaifliklar ekspluatatsiyasi deb o'ylashga undadi. Biz dastlabki kirishning aniq PHP2Shell CVE'lari bilan bog'liq ekanligini tasdiqlay olmaymiz."
Asl hikoya quyidagicha.
Tahdid aktorlari CVE-2026-109618 va CVE-2026-109619 sifatida kuzatilgan PHP2Shell zaifliklaridan foydalanishdan keyin post-ekspluatatsiya faoliyati uchun agentik sun'iy intellekt (AI) platformalaridan foydalanayotgani kuzatilgan.
"Bir holatda hujumchilar Yevropadagi davlat tashkilotini nishonga oldilar va dastlabki ekspluatatsiyadan ikki soat ichida parol xeshlarini va ko'p faktorli autentifikatsiya sirlarini muvaffaqiyatli qo'lga kiritdilar," deb aytdi Palo Alto Networks Unit 42.
"Ular shuningdek, NT LAN Manager (NTLM)-rele tunnelini Active Directory'ga o'rnatdilar va Domain Admin huquqlarini oshirishga urindilar."
Tarmoq xavfsizligi kompaniyasi shuningdek, noma'lum hujumchi buzilgan endpointni tekshirganini, buyruqlar va xulq-atvor belgilari agentik hujumchining ishini ko'rsatganini aytdi. Bular quyidagilarni o'z ichiga oladi:
- O'g'irlangan ma'lumotlar bilan autentifikatsiya ma'lumotlar bazasini tekshirish, parol xeshlarini va ikki faktorli autentifikatsiya (2FA) sirlarini nishonga olish.
- Domen nazoratchisiga (DC) curl asosidagi anonim LDAP so'rovlari orqali Active Directory (AD) tekshiruvi, administrator hisobini qidirish maqsadida.
- Xostni tekshirish, DNS/AD integratsiyasi, ichki xostlar, imtiyozli guruhlar va interaktiv foydalanuvchilarni qidirish.
"Har bir buyruq partiyasi ==SHELLUSER== va ==PASSWD== kabi bo'lim sarlavha ajratgichlari bilan o'ralgan," deb qo'shdi u. "Bu ajratgichlar AI model o'qishi uchun mashina-pars qilinadigan natija hosil qiladi."
Shubhali Shimoliy Koreya Kampaniyasi PHP2Shell'ni Nishonga Oladi
Bu ma'lumot CYFIRMA 21 ta buzilgan tugundan global PHP infratuzilmasini faol ravishda tekshirayotgan shubhali Shimoliy Koreya bilan bog'liq kampaniyani aniqlaganini e'lon qilgan paytda keldi.
"Skanerlash ataylab past hajmli va sekinlashtirilgan," deb aytdi Kumar Ritesh, CYFIRMA'ning CEO va asoschisi, The Hacker News'ga. "Tugunlar aylantiriladi va bloklash yoki tezlik cheklashning birinchi belgisida tashlab ketiladi, shuning uchun chegara asosidagi ogohlantirish uni ushlashi ehtimoli kam."
Nishonlar AQSh, Yaponiya, Janubiy Koreya, Tailand, Indoneziya, Avstraliya, Tayvan, Hindiston, Singapur, BAA, Saudiya Arabistoni va Yevropa Ittifoqida joylashgan 216 ta yangilanmagan yoki qisman yumshatilgan xostlardan iborat. Xostlar davlat, moliyaviy muassasalar, logistika, aeroportlar va aviatsiya, ishlab chiqarish va onlayn tranzaksiya platformalarini qamrab oladi.
"Kampaniya tekshiruvdan faol, past va sekin skanerlashga o'tdi, filtrlangan nishon to'plamiga qaratilgan," deb aytdi CYFIRMA. "Ustuvor sektorlar va geografiyalardagi tashkilotlar o'zlarini ataylab nishonga olingan deb hisoblashlari kerak."
Yopiq I2P kanali orqali muvofiqlashtirilgan faoliyat, Lazarus Group ekotizimiga aloqador deb baholangan koreys tilida so'zlashuvchi operatorga o'rtacha ishonch bilan bog'langan. CYFIRMA ma'lumotlariga ko'ra, I2P kanalida faol bo'lgan ikkita taxallus (전창혁 2 aka Jeon Chang-hyuk 2) va (최아린 aka Choi A-rin) avval tahdid aktorlari uchun yashirin operatsiyalarni amalga oshirgan.
"Koreys tilida so'zlashuvchi operatorlar [kanalni] nishon ro'yxatlari, ekspluatatsiya-xosting infratuzilmasi va DPRK maqsadlariga mos keladigan vazifalar va ustuvorlikni almashish uchun ishlatgan," deb aytdi Ritesh. "Qo'lga kiritilgan suhbat Shimoliy Koreya (Munhwaŏ) ga xos lug'at va imloni ishlatadi, Janubiy Koreya standartidan farqli ravishda."
Kampaniyani Lazarus klasteriga bog'laydigan boshqa asosiy ko'rsatkichlar quyidagilar:
- Lazarus avval veb aktivlarini ekspluatatsiya qilish uchun ishlatgan buyruq va nazorat (C2) infratuzilmasi.
- Lazarus Group'ning PHP va WordPress serverlarini C2 uchun buzish va PHP va ASP veb qobiqlarini joylashtirish bo'yicha hujjatlashtirilgan tarixi, SyncHole suv teshigi kampaniyasida kuzatilganidek.
- Davlat agentliklari va banklarni, xususan onlayn tranzaksiya platformalarini ustuvor qilish, bu Lazarus Group'ning moliyaviy muassasalarni moliyaviy va kriptovalyuta o'g'irlash uchun buzish tarixi bilan mos keladi.
"Ekspluatatsiya keyingi qadam," deb aytdi CYFIRMA. "Operatorlar o'sha kuni eng istiqbolli nishonlarni qisqartirishlarini va keyin qaysi ommaviy ekspluatatsiyalarni moslashtirishni tanlashlarini aytishdi."
Boshqa Ekspluatatsiya Urinishlari va Yumshatish Choralari
2026-yil 25-oktabrda X'da e'lon qilingan postda Defused Cyber PHP2Shell tekshiruvlarini Palo Alto Networks GlobalProtect asalari (honeypot) lariga qaratilganini ham ko'rayotganini aytdi. Faoliyat [204.76.203[.]7](https://www.virustotal.com/gui/ip-address/204.76.203.7/) dan keladi, bu ma'lum ommaviy ekspluatatsiya IP manzili.
"So'rovlar PHPSESSIONUPLOAD_PROGRESS markerini ('p2s-rider') va yuklanmagan fayl yuklashni o'z ichiga oladi, bu kimdir zaif yuklash-progress xulq-atvorini tekshirayotganini va ehtimol Palo Alto qurilmalarining nishon ro'yxatini tuzayotganini ko'rsatadi," deb aytdi tahdid razvedkasi kompaniyasi.
CVE-2026-109618 va CVE-2026-109619 ikkalasi ham standart PHP konfiguratsiyalarida masofaviy kod bajarilishiga olib kelishi mumkin bo'lgan muhim zaifliklardir. Xavfsizlik kamchiliklari keng tarqalgan skanerlash urinishlarini ko'rdi, Cloudflare ommaviy e'lon qilingandan keyin millionlab ekspluatatsiya urinishlarini aniqlaganini aytdi.
"Hujumchi ikkita asosiy cheklovga duch keladi: ular so'rovni to'g'ri vaqtda ajratish muvaffaqiyatsiz bo'lishi uchun o'lcham berishlari va ASLR'ni yengishlari kerak, bu esa haqiqiy xotira manzillarini topish uchun," deb aytdi Datadog. "Ekspluatatsiya qabul qilingan so'rov tanasiga sig'adigan, lekin kalitini nusxalash xotira_limit'dan oshib ketadigan darajada katta bo'lgan bitta maydon nomini talab qiladi."
"PHP forma-maydon nomini tahlil qilganda, u yo'l davomida bir necha nusxa hosil qiladi. Hujumchi bu qo'shimcha xotiradan foydalanib, PHP nomni xesh jadvaliga nusxalashda ajratish muvaffaqiyatsizligini majburlaydi."
ReliaQuest 2026-yil 22-oktabrda e'lon qilingan yangilanishda CVE-2026-109618 ni nazorat qilinadigan laboratoriyada qayta ishlab chiqqanini va himoyachilarga ekspluatatsiyani aniqlashda yordam berishi mumkin bo'lgan xatolar ketma-ketligini kuzatganini aytdi.
"Bu sinov PHP xato, Apache kirish, Apache xato va tizim jurnallarida aniq artefaktlar ketma-ketligini aniqladi, bu himoyachilarga ekspluatatsiyani aniqlashda yordam berishi mumkin," deb aytdi u. "Himoyachilar ketma-ketlikka e'tibor qaratishlari kerak: POST so'rovi 500 xato qaytaradi, PHP xotira tugashi va heap buzilishini xabar qiladi va so'rovni qayta ishlovchi Apache ishchisi ishdan chiqadi."
PHP Foundation shundan beri uchinchi masofaviy kod bajarilish zaifligi (CVE-2026-115560) haqida ogohlantirdi, bu faqat "konfiguratsiya va ilova kodining g'ayrioddiy kombinatsiyasi ostida" yuz berishi mumkin. Muammo muntazam chiqarish siklining bir qismi sifatida hal qilinishi kutilmoqda.
"Ilova konfiguratsiyasida session.serializehandler'ni phpbinary yoki phpserialize qilib o'rnatishi va keyin sessionstart() chaqirishdan oldin ini_set() bilan uni php'ga o'zgartirishi kerak," deb aytdi Foundation. "Sessiya yuklash progressi ham hali yoqilgan bo'lishi kerak. Serialize handler'ni ish vaqti davomida hech qachon o'zgartirmaydigan ilovalar bu xususiyatni yoqilgan holda saqlashlari mumkin."
Xint xost PHP2Shell'ga ochiq ekanligini tekshirish uchun skaner chiqardi va har qanday PHP skriptida, ilovadan qat'i nazar, va dekodlash sodir bo'ladigan ilovalarda, masalan session_start() va unserialize() bilan masofaviy kod bajarilishi mumkinligini aytdi.
Bitsight'ning internet bo'ylab skanerlari shuni ko'rsatadiki, PHP yoki PHP bilan bog'liq dasturiy ta'minotni ishlatayotgan deyarli 37 million internetga ulangan tizim mavjud, ko'pchilik AQSh, Germaniya, Fransiya, Niderlandiya va Yaponiyada.
"PHP vebning juda katta qismini ishlaydi, kontent boshqaruv tizimlari va onlayn do'konlardan tortib maxsus ichki vositalargacha," deb aytdi Bitsight. "Ishlash vaqtidagi kamchilik ilova kodini o'zgartirish bilan tuzatilmaydi va veb-ilova xavfsizlik devori yoki plagin yangilanishi uni yo'q qilmaydi. Faqat xostning o'zida PHP'ni yangilash bo'shliqni yopadi."
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.
"What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application," a spokesperson for the company told The Hacker News via email. "This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs."
The original story follows.
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said.
"They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation."
The network security company said it also observed the unknown attacker enumerating the compromised endpoint, with commands and behavioral markers suggesting the work of an agentic attacker. These include commands to facilitate -
- Reconnaissance of the authentication database with stolen credentials, targeting password hashes and two-factor authentication (2FA) secrets.
- Active Directory (AD) reconnaissance via curl-based anonymous LDAP queries to the domain controller (DC) in an attempt to look for the administrator account.
- Reconnaissance of the host to hunt for DNS/AD integration, internal hosts, privileged groups, and interactive users.
"Each command batch is wrapped in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==," it added. "These delimiters produce machine-parseable output for an AI model to read."
Suspected N. Korea Campaign Targets PHP2Shell
The disclosure comes as CYFIRMA said it uncovered a suspected North Korea-linked campaign employing PHP2Shell to actively probe global PHP infrastructure from 21 compromised nodes.
"The scanning is deliberately low-volume and paced," Kumar Ritesh, CEO and founder of CYFIRMA, told The Hacker News. "Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it."
The targets comprise a set of 216 unpatched or partially mitigated hosts located across the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia, and the E.U. The hosts span government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms.
"The campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set," CYFIRMA said. "Organizations in the prioritised sectors and geographies should assume they are in scope for deliberate targeting."
The activity, coordinated via a closed I2P channel, has been attributed with moderate confidence to a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem. According to CYFIRMA, the two handles (전창혁 2 aka Jeon Chang-hyuk 2) and (최아린 aka Choi A-rin) active in the I2P channel have previously been observed running covert operations for the threat actors.
"Korean-speaking operators have used [the channel] to share target lists, exploit-hosting infrastructure, and tasking and prioritisation consistent with DPRK objectives," Ritesh said. "The captured conversation uses vocabulary and spelling specific to North Korean (Munhwaŏ) rather than the South Korean standard."
Other primary indicators that link the campaign to the Lazarus cluster are below -
- Command-and-control (C2) infrastructure that Lazarus has previously used to exploit web assets.
- Lazarus Group's documented history of compromising PHP and WordPress servers for C2 and planting of PHP and ASP web shells, as observed in the SyncHole watering hole campaign.
- Prioritizing government agencies and banks, specifically online transaction platforms, which is in line with Lazarus Group's track record of breaching financial institutions for financial and cryptocurrency theft.
"Exploitation is the next step," CYFIRMA said. "The operators said they would shortlist the most promising targets the same day and then choose which public exploits to adapt."
Other Exploit Efforts and Mitigations
In an October 25, 2026, post shared on X, Defused Cyber said it's also seeing PHP2Shell probes targeting its Palo Alto Networks GlobalProtect honeypots. The activity originates from [204.76.203[.]7](https://www.virustotal.com/gui/ip-address/204.76.203.7/), a known mass-exploit IP address.
"The requests carry a PHPSESSIONUPLOAD_PROGRESS marker ('p2s-rider') and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices," the threat intelligence company said.
Both CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities that can lead to remote code execution in default PHP configurations. The security flaws have witnessed widespread scanning efforts, with Cloudflare stating it detected millions of exploitation attempts after public disclosure.
"An attacker faces two main constraints: they must size a request to fail allocation at the right moment, and they must defeat ASLR to find valid memory addresses," Datadog said. "The exploit needs one field name small enough to fit inside the accepted request body but large enough that copying its key exceeds memory_limit."
"When PHP parses a form-field name, it makes several copies along the way. The attacker uses that extra memory to force an allocation failure while PHP copies the name into a hash table."
ReliaQuest, in an update published on October 22, 2026, said it reproduced CVE-2026-109618 in a controlled lab and observed a sequence of errors that could help defenders identify exploitation.
"This testing identified a specific sequence of artifacts across PHP error, Apache access, Apache error, and system logs that may help defenders detect exploitation," it said. "Defenders should focus on the sequence: a POST request returns a 500 error, PHP reports memory exhaustion and heap corruption, and the Apache worker handling the request crashes."
The PHP Foundation has since warned of a third remote code execution vulnerability (CVE-2026-115560), which can only "occur under an unusual combination of configuration and application code." The issue is expected to be addressed as part of the regular release cycle.
"An application must set session.serializehandler to phpbinary or phpserialize in its configuration and then switch it to php at runtime with iniset() before calling session_start()," the Foundation said. "Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled."
Xint has released a scanner to check if a host is exposed to PHP2Shell, stating remote code execution is possible in any PHP script regardless of the application and in applications where decoding occurs, such as with session_start() and unserialize().
Bitsight's internet-wide scans show that there are nearly 37 million internet-facing systems running PHP or PHP-related software, with most of the exposures in the U.S., Germany, France, the Netherlands, and Japan.
"PHP runs a very large portion of the web, from content management systems and online shops to bespoke internal tools," Bitsight said. "A flaw in the runtime can't be repaired by changing application code, and a web application firewall or plugin update won’t remove it. Only updating PHP on the host itself closes the gap."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.