Zaifliklar
PHP2Shell zaifliklaridan foydalanish tekshiruvlardan haqiqiy shellarga o'tdi
Hujumchilar PHP2Shell zaifliklarini honeypot serverlarida shell buyruqlarini bajarish uchun muvaffaqiyatli ishlatishdi, deb xabar berdi tadqiqotchi dam olish kunlari.
CVE-2026-109618 va CVE-2026-109619 sifatida kuzatilgan tanqidiy PHP2Shell zaifliklari autentifikatsiyasiz masofaviy kod bajarish uchun ishlatilishi mumkin. PHP ularni 21-oktabrda, ba'zi ma'lumotlar onlayn tarzda tarqalganidan keyin tuzatdi.
Ekspluatatsiya urinishlari tuzatishlar chiqarilishidan oldin boshlangan va shundan beri millionlab qayd etilgan, ammo xavfsizlik firmalari muvaffaqiyatli kod bajarilishini tasdiqlamagan. Tadqiqotchilar, ammo, ASLR himoyalarini chetlab o'ta oladigan ekspluatatsiyalarni ishlab chiqqan edilar.
Perplexity tadqiqotchisi Adel Karimi oddiy PHP bilan ishlaydigan sahifalarni taqdim etadigan honeypotlarni boshqaradi, Apache mod_php bilan PHP 8.4.26 dan foydalanib, bitta ishchi bilan. Uning birinchi hisoboti, 26 soatdan sal ko'proq faoliyatni qamrab olgan, 30 ta xotira tugashi xatosi va 11 ta ishchi ishdan chiqishini qayd etdi, ammo kod bajarilishini emas.
Bu 24-oktabrda o'zgardi, Karimi sensorlari uchta honeypotda 35 ta shell ishga tushirilganini qayd etdi. Bitta IP manzil bitta honeypotda uchta shell yaratdi, ikkinchisi esa uchta honeypotda 32 ta shell yaratdi.
Hujumchilar to'rt bosqichli HTTP so'rovlar zanjiridan foydalangan. Ba'zi so'rovlar PHP xotirasini tugatgan, boshqalari xotira mazmunini ochib bergan, oxirgisi esa shell buyrug'ini bajargan. Trafik ochiq isbot-konsepsiya (PoC) ekspluatatsiyasiga juda yaqin mos kelgan va faoliyat CVE-2026-109618 ekspluatatsiyasiga mos keladi, Karimi fikricha.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
"Bu endi tasdiqlangan RCE, foydalanish mumkin bo'lgan xotira ochilishi bilan, shunchaki ishdan chiqish va shubhali jarayon emas," deb yozdi u X da.
Ikkinchi bosqichli yuklab olish kuzatilmagan.
Karimi natijalarni ortiqcha talqin qilishdan ogohlantirdi. "Dalillar bu zanjirni ataylab qulay bitta ishchi mod_php profilida ko'rsatadi; bu boshqa ishchi sonlari, PHP tuzilmalari yoki ilovalarda ekspluatatsiya ishonchliligi o'lchovi emas," dedi u.
Expel asosiy tahdid tadqiqotchisi Marcus Hutchins topilmalarni "hozirgacha ko'rgan eng yuqori sifatli PHP2Shell ekspluatatsiyasining tasdiqlanishi" deb ta'rifladi.
CISA 23-oktabrda PHP2Shell ogohlantirishini Sigma aniqlash qoidasini qo'shish bilan yangilaganida, muvaffaqiyatli ekspluatatsiya kuzatilmaganini aytgan. 26-oktabr tongida agentlik zaifliklarni Ma'lum Ekspluatatsiya Qilingan Zaifliklar (KEV) katalogiga qo'shmagan.
Bog'liq: Mirai Botnet Operatorlari PHP2Shell Hujumlariga Qo'shiladi, ASLR Chetlab O'tish Ekspluatatsiyalari Paydo Bo'ladi
Bog'liq: Texnologiya va Xavfsizlik Kompaniyalari PHP2Shell Zaifliklariga Javob Beradi
Bog'liq: Node2Shell: Brotli Zaifligi Microsoft, Node.js, Python Paketlarida Tuzatishlarni Keltirib Chiqaradi
YozganEduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta boshqaruvchi muharrir. U jurnalistika karerasini 2011-yilda boshlashdan oldin o'rta maktab IT o'qituvchisi bo'lib ishlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va kompyuter texnikasi elektr muhandisligida qo'llaniladigan magistr darajasiga ega.
Kundalik Axborot Byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek Email Axborot Byulleteniga obuna bo'ling.
Biznes Email*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Eduard Kovacsdan ko'proq
- Atlassian Data Center va Server Mahsulotlarida 75 ta Zaiflikni Tuzatdi
- Eronning Fors Shahzodasi APT C&C ni 2016-yildan beri birinchi marta AQShda joylashtirdi
- Texnologiya va Xavfsizlik Kompaniyalari PHP2Shell Zaifliklariga Javob Beradi
- Oracle 2026-yil Oktyabr CPU bilan 1200 dan ortiq Zaiflikni Tuzatdi
- Google Chrome'ni ClickFix Hujumlari va Xavfsiz HTTP Ulanishlariga Qarshi Qattiqlashtirdi
- OpenAI Agentlari Xavfsizlik Jamoasi Ogohlantirishlarini Sustlashtirdi, Mos Kelmaslik Monitorini Olib Tashladi
- Buzilgan Ishlab Chiquvchi Hisobi OVHcloud CLI'da O'g'irlovchini O'rnatish Uchun Ishlatildi
- Accenture, Dragos, SANS Kichik AQSh Kommunal Xizmatlarini Himoya Qilish Uchun 10 Million Dollarlik Tashabbusni Ishga Tushirdi
So'nggi Yangiliklar
- 953 ta Onlayn Do'kon Uzoq Davom Etgan Zararli Dastur Kampaniyasida Infektsiyalangan
- Golland Politsiyasi NFC Relay Hujumlari Orqali Bank Hisoblaridan 400 000 dollardan ortiq Mablag'ni O'g'irlagan Ikki Shaxsni Hibsga Oldi
- Node2Shell: Brotli Zaifligi Microsoft, Node.js, Python Paketlarida Tuzatishlarni Keltirib Chiqaradi
- Mythos 5 Iyul Hujumida Haqiqiy Dunyoga Zararni E'tiborsiz Qoldirdi
- Sobiq Unit 8200 Ofitserlari Agentik SecOps Startapi Mave Uchun 34 Million Dollar Yig'di
- Boshqa Yangiliklarda: Tor Chiqish Relaylari Buzildi, Banklar Yovuz AI Agentlarini Aniqladi, O'zini Tiklaydigan macOS Ransomware
- Mirai Botnet Operatorlari PHP2Shell Hujumlariga Qo'shiladi, ASLR Chetlab O'tish Ekspluatatsiyalari Paydo Bo'ladi
- Xitoy APT AI Pentest Vosita Artexni ConnectWise Hujumlarida Ishlatadi
Trendda
Mirai Botnet Operatorlari PHP2Shell Hujumlariga Qo'shiladi, ASLR Chetlab O'tish Ekspluatatsiyalari Paydo Bo'ladi
SecurityWeek Tahlili: 2024-yil Birinchi Yarimida 178 ta Kiberxavfsizlik M&A Bitimlari E'lon Qilindi
Sobiq Unit 8200 Ofitserlari Agentik SecOps Startapi Mave Uchun 34 Million Dollar Yig'di
Xitoy APT AI Pentest Vosita Artexni ConnectWise Hujumlarida Ishlatadi
Boshqa Yangiliklarda: Tor Chiqish Relaylari Buzildi, Banklar Yovuz AI Agentlarini Aniqladi, O'zini Tiklaydigan macOS Ransomware
Atlassian Data Center va Server Mahsulotlarida 75 ta Zaiflikni Tuzatdi
Hujumchilar To'rtinchi Oyda Uchinchi Arista VCO Zero-Day'ni Ekspluatatsiya Qiladi
Node2Shell: Brotli Zaifligi Microsoft, Node.js, Python Paketlarida Tuzatishlarni Keltirib Chiqaradi
Kundalik Axborot Byulleteni
So'nggi tahdidlar, tendensiyalar, texnologiya va soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek Email Axborot Byulleteniga obuna bo'ling.
Biznes Email*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI Kirish Xavfi Allaqachon Mavjud
19-oktabr, 2026
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini ochib berish va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan O'ting
Virtual Tadbir: CISO Forumi 2026 Sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori darajali kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan O'ting
Harakatdagi Odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber Integratsiya bo'yicha Yordamchi Direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi Ko'proq Odamlar
Mutaxassis Fikrlari
*
AI Dasturiy Ta'minot Xavfsizligining Kaliti Tezlik Emas, Balki Yetuklik
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda turishi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi.(Matias Madou)
Zamonaviy Kiberhujumlarga Qarshi Kurashda Kontekst Qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni ulash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi.(Etay Maor)
AI Hujum Tezligini O'zgartirdi, Xavfsizlik Asoslarini Emas
AI zaifliklarni aniqlash va ekspluatatsiya qilishni tezlashtirgan sari, virtual tuzatish hali ham himoya chuqurligi va kuchli ilova xavfsizligi asoslariga bog'liq.(Joshua Goldfarb)
Kelajak Uchun Katta Rejalar Tuzgan To'rtta Kiber Tahdid
- AI, ta'minot zanjiri ochiqligi, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak.(Steve Durbin)
Oxiridan Boshlang: Agentik Tuzatishni Qanday Faollashtirish Kerak
Agentik tuzatish ishonch harakati emas. Biz tanish muammolarni tuzatish haqida gapiryapmiz, notanish xavf haqida hukm chiqarish emas.(Nadir Izrael)
Vulnerabilities
PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.
By
Eduard Kovacs
| October 26, 2026 (9:30 AM ET)
*
Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend.
Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online.
Exploitation attempts began before the fixes were released, and millions have been recorded since, but security firms had not confirmed any successful code execution. Researchers had, however, developed exploits capable of bypassing ASLR protections.
Perplexity researcher Adel Karimi runs honeypots that present ordinary PHP-backed pages, using PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours of activity, logged 30 out-of-memory errors and 11 worker crashes, but no code execution.
That changed on October 24, when Karimi’s sensors recorded 35 shells launched across three honeypots. One IP address produced three shells on a single honeypot, while another spawned 32 shells across all three.
The attackers used a four-stage chain of HTTP requests. Some requests exhausted PHP’s memory, others leaked memory contents, and the last executed a shell command. The traffic closely matched a public proof-of-concept (PoC) exploit, and the activity is consistent with exploitation of CVE-2026-109618, according to Karimi.
Advertisement. Scroll to continue reading.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” he wrote on X.
No second-stage payload download was observed.
Karimi cautioned against reading too much into the results. “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,” he said.
Expel principal threat researcher Marcus Hutchins described the findings as “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”
When CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, it said it had not observed successful exploitation. As of the morning of October 26, the agency had not added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Related: Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- Atlassian Patches 75 Flaws in Data Center and Server Products
- Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
- Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
- Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities
Latest News
- 953 Online Stores Infected in Long-Lasting Malware Campaign
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- Mythos 5 Ignored Real-World Harm in July Attack
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Trending
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Atlassian Patches 75 Flaws in Data Center and Server Products
Attackers Exploit Third Arista VCO Zero-Day in Four Months
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)