Amazon xabar berishicha, tahdid aktorlari PHP'dagi ikkita muhim masofaviy kod bajarish (RCE) zaifliklari ta'sir qilgan serverlarni tekshirishni yamoqlar chiqarilishidan to'rt kun oldin boshlagan.
PHP2Shell deb nomlangan va CVE-2026-109618 hamda CVE-2026-109619 sifatida kuzatilgan bu ikkita kamchilik uchun yamoqlar 21-oktabrda chiqarildi, PHP Foundation va soha hamkorlari ularni qurish, tekshirish va tasdiqlash uchun bir necha hafta shoshilinch ishladi.
20-oktabrda ikkala muammo ham onlayn tarzda sizdirildi, bu esa isbot-konsept (PoC) ekspluatatsiyalarining tarqalishini tezlashtirdi. Bir nechta tashkilot bu faoliyatni kuzatdi, lekin ekspluatatsiya urinishlari muvaffaqiyatsiz bo'lganini aytdi.
Amazon ma'lumotiga ko'ra, birinchi PHP2Shell ekspluatatsiyasi 17-oktabrda, xavfsizlik kamchiliklari hali embargo ostida bo'lgan paytda sodir bo'lgan va tijorat anonimlashtirish tarmog'idan kelib chiqqan.
"Anonimlashtirilgan IP manzildan honeypotga qaratilgan hujum bu faoliyat tahdid aktori tomonidan amalga oshirilganini ko'rsatadi, garchi aktor ekspluatatsiya ma'lumotini oshkor etilishidan oldin qanday olganligi noaniq qolsa-da," deydi Amazon.
Ommaviy oshkor etilishdan taxminan 12 soat oldin Amazon qo'shimcha anonimlashtirilgan infratuzilmadan PHP2Shell uchun bir nechta PoC'larni aniqladi. Yuklamalardagi farqlar va manbalar bir nechta tahdid aktorlari jalb qilinayotganini ko'rsatadi. Reklama. O'qishni davom ettirish uchun pastga aylantiring.
"Embargo bekor qilingach va yamoq chiqarilgach, bir necha soat ichida qo'shimcha isbot-konsept ekspluatatsiyalari paydo bo'ldi va biz ularni sensorlarimizga qarshi deyarli darhol ishlatilganini ko'rdik. PHP2Shell endi yovvoyi tabiatda keng tarqalgan holda ekspluatatsiya qilinmoqda," deb ta'kidlaydi Amazon.
WatchTowr ham yamoqlar chiqarilgandan so'ng darhol keng tarqalgan ekspluatatsiyani kuzatdi, garchi tarqalayotgan PoC'larning hech biri RCE'ga erishmasa ham.
"Butunlay bashorat qilinadigan voqealar zanjirida WatchTowr Intel keng tarqalgan ekspluatatsiya urinishlari va Twitter'da tvit qilingan hamda GitHub'ga tashlangan beparvo isbot-konsept ekspluatatsiya kodini ko'rmoqda. Tasodifiy ravishda sepilayotgan ekspluatatsiyalar umuman ishlamaydi, vaqtga asoslangan farqlarni tekshiradi yoki maqsadni ishdan chiqaradi," dedi WatchTowr tahdid razvedkasi rahbari Jake Knott elektron pochta orqali yuborilgan bayonotda.
Hadrian, Patchstack va Cloudflare barchasi yamoqlar chiqarilishidan bir necha soat oldin ekspluatatsiya urinishlarini kuzatganini xabar qildi.
"Ommaviy e'lon qilinishidan oldingi 10 soat ichida Cloudflare tarmog'i bo'ylab biz uni ekspluatatsiya qilish uchun minglab urinishlarni ko'rdik," dedi Cloudflare bosh direktori Matthew Prince payshanba kuni erta tongda. "Bu e'lon qilinganidan keyingi 45 daqiqada o'n minglab, 2 soat ichida yuz minglab va hozir millionlabga yetdi."
Bundan tashqari, JFrog GitHub'da soxta PoC ekspluatatsiyalari va hazil zararli dasturlar nashr etilayotganini kuzatdi.
VulnCheck SecurityWeek'ga kamida bitta Xitoy IP manzili PHP2Shell'ni muvaffaqiyatsiz ravishda ekspluatatsiya qilib, veb-shell joylashtirishga uringanini aytdi.
VulnCheck, VirusTotal va Censys ma'lumotiga ko'ra, 21-oktabr holatiga ko'ra 1 milliondan ortiq PHP serverlari yamoqlanmagan dasturiy ta'minot versiyalarini ishlatayotgan edi.
21-oktabrda ko'rilgan 2,58 million internetga ulangan xostlardan taxminan 1,58 millioni aniqlanadigan PHP versiyalarini xabar qilgan va taxminan 1,57 millioni yamoqlanmagan edi, deydi Censys. 22-oktabr holatiga ko'ra platforma PHP ishlatayotgan deyarli 3 million internetga ulangan xostni kuzatmoqda.
VulnCheck PHP ishlatayotgan 2,6 milliondan ortiq internetga ulangan xostni ko'rgan, ularning deyarli barchasi zaif edi. Kamida 1 millioni umr oxiriga yetgan (EoL) PHP versiyalarini ishlatadi: 700 000 dan ortig'i PHP 3.x – 7.3 va deyarli 400 000 PHP 7.4, 8.0 yoki 8.1.
VirusTotal PHP ishlatayotgan taxminan 5,1 million IP manzilini ko'radi, lekin ulardan faqat 1,1 millioni HTTP sarlavhasida versiyani e'lon qiladi. Ulardan faqat taxminan 272 000 ta qo'llab-quvvatlanadigan PHP versiyasini ishlatadi, aksariyati (taxminan 758 000) EoL iteratsiyasini (PHP 5.4 dan 8.1 gacha) ishlatadi.
Bu PHP xostlarining aksariyati (~920 000) AQShda joylashgan. Yaxshi xabar shuki, ular AWS, DigitalOcean, Alibaba, OVHcloud va Hetzner kabi bir nechta provayderlarda ishlaydi, shuning uchun tuzatish oddiy konfiguratsiya surishlari va WAF qoidalarini o'z ichiga oladi.
Kiberxavfsizlik hamjamiyati javobi
Chorshanba kuni AQSh kiberxavfsizlik agentligi CISA tashkilotlarni darhol PHP 8.5.12, 8.4.27, 8.3.36 yoki 8.2.35 ga yangilashga chaqirdi, bu versiyalar ikkala PHP2Shell kamchiliklari uchun tuzatishlarni o'z ichiga oladi.
"Tashkilotlar tezda yamoqlashda qiynaladi, lekin qiyinroq muammo yamoqlanishi kerak bo'lgan hamma narsani topishdir. Bunday voqealar unutilgan ilovalarni, soyali tizimlarni va tarmoq egalari hatto mavjudligini bilmaydigan PHP o'rnatishlarini fosh qiladi," dedi BlueVoyant CISO John Harbaugh.
Ba'zi konfiguratsiyalarda zaifliklar xavfsizlik tekshiruvlari ishlashidan oldin kodni bajarish uchun ekspluatatsiya qilinishi mumkinligi sababli, barcha manfaatdor tomonlar shoshilinch yangilanishlarni darhol qo'llashi va buzilish belgilarini tekshirishni boshlashi kerak, deydi ThreatLocker hammuassisi va CTO Michael Jenkins.
"Har bir tizim yamoqlanmaguncha, vebga ulangan jarayon nima ishga tushirishi, kirishi yoki ulanishi mumkinligini cheklaydigan nazoratlar hujumchining imkoniyatlarini kamaytiradi. Bu nazoratlar yamoqlash o'rnini bosmaydi, balki orqa tayanchdir va keyinchalik ham saqlanishi kerak. PHP jarayoni odatda faqat saytni ishlatish uchun zarur bo'lgan fayllar va tarmoq xizmatlariga kirish huquqiga muhtoj. Boshqa hamma narsani cheklash buzilgan veb-serverning kengroq biznesga kirish eshigiga aylanishining oldini olishga yordam beradi," deb qo'shdi Jenkins.
Forescout tahdid ovlash katta menejeri Sai Molige va Expel asosiy tahdid tadqiqotchisi (va sobiq xaker) Marcus Hutchins fikricha, PHP2Shell Log4Shell bilan taqqoslanadi.
"PHP2Shell Log4Shell miqyosidagi voqea bo'lish salohiyatiga ega, lekin boshqa sabab bilan. Log4j bilan asosiy muammo sizda borligini bilmagan kutubxonani topish edi. PHP bilan unutilgan infratuzilmaning ko'p qismi topiladi, lekin yuqori oqim tuzatishi bo'lmaydi. Log4j'dan olingan doimiy dars shuki, tashkilotlar 'Biz X qayerda ishlashini qanchalik tez aniqlay olamiz?' degan savolni yamoqlash tezligidan alohida o'lchanadigan qobiliyat sifatida ko'rishi kerak," dedi Molige.
"Men PHP2Shell Log4J yo'lida 50% masofada deb aytgan bo'lardim. Keng tarqalgan ta'sir. To'g'ridan-to'g'ri ekspluatatsiya yomonroq. Log4J kabi uchinchi tomon dasturiy ta'minotiga chuqur singib ketmaganligi sababli qisqaroq dum va bilvosita ekspluatatsiya," dedi Hutchins.
Bog'liq: Oracle 2026-yil oktyabr CPU bilan 1200 dan ortiq zaiflikni yamoqladi
Bog'liq: Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
Bog'liq: 'Kontekst bombalari' AI hujum muvaffaqiyatini soxta maqsadlar bilan chalg'itib kamaytiradi
Bog'liq: Kontekst zamonaviy kiberhujumlarga qarshi kurashda qirol
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Threat actors started probing for servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before the fixes, Amazon reports.
Patches for the two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were released on October 21, after the PHP Foundation and industry partners scrambled for weeks to build, verify, and validate them.
On October 20, both issues were leaked online, which accelerated the circulation of proof-of-concept (PoC) exploits. Multiple organizations observed the activity, but said the exploitation attempts were unsuccessful.
According to Amazon, the first PHP2Shell exploitation occurred on October 17, while the security defects were still under embargo, and originated from a commercial anonymization network.
“The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” Amazon says.
Roughly 12 hours before the public disclosure, Amazon identified multiple PoCs for PHP2Shell from additional anonymized infrastructure. The variations in payloads and origin suggest that multiple threat actors were getting involved.Advertisement. Scroll to continue reading.
“Once the embargo was lifted and the patch was released, additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately. PHP2Shell is now being broadly exploited in the wild,” Amazon notes.
WatchTowr too observed mass exploitation shortly after the patches were released, albeit none of the circulating PoCs achieve RCE.
“In an entirely predictable chain of events, WatchTowr Intel is seeing broad exploitation attempts and sloppy proof-of-concept exploit code tweeted and thrown onto GitHub. The exploits being sprayed indiscriminately either don’t work at all, test for timing-based differences, or crash the target,” WatchTowr head of threat intelligence Jake Knott said in an emailed statement.
Hadrian, Patchstack and Cloudflare all reported seeing exploitation attempts hours before the fixes were released.
“In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said early on Thursday. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Additionally, JFrog has observed fake PoC exploits and prank malware being published on GitHub.
VulnCheck told SecurityWeek that at least one Chinese IP address unsuccessfully attempted to exploit PHP2Shell to deploy a webshell.
According to VulnCheck, VirusTotal, and Censys, more than 1 million PHP servers were running unpatched software releases as of October 21.
Out of 2.58 million internet-facing hosts seen on October 21, roughly 1.58 million were reporting identifiable PHP versions, and approximately 1.57 million were not patched, Censys says. As of October 22, the platform tracks nearly 3 million internet-facing hosts running PHP.
VulnCheck was seeing more than 2.6 million internet-facing hosts running PHP, nearly all of which were vulnerable. At least 1 million run end-of-life (EoL) PHP versions: more than 700,000 are PHP 3.x – 7.3 and nearly 400,000 are PHP 7.4, 8.0, or 8.1.
VirusTotal says it sees roughly 5.1 million IP addresses running PHP, but only 1.1 million of them announce a version in an HTTP header. Of these, only approximately 272,000 run a supported PHP version, while the majority (around 758,000) run an EoL iteration (PHP 5.4 to 8.1).
Most of these PHP hosts (~920,000) are in the US. The good news is they run on a handful of providers, including AWS, DigitalOcean, Alibaba, OVHcloud, and Hetzner, so remediation would involve simple configuration pushes and WAF rules.
Cybersecurity community response
On Wednesday, the US cybersecurity agency CISA urged organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, which include fixes for both PHP2Shell flaws.
“Organizations will struggle to patch quickly, but the harder problem is finding everything that needs patching. Events like this expose forgotten applications, shadow systems and PHP installations that network owners may not even know exist,” BlueVoyant CISO John Harbaugh said.
Because in some configurations the vulnerabilities can be exploited to execute code before the security checks run, all stakeholders should apply the emergency updates immediately and start investigating for signs of compromise, says ThreatLocker co-founder and CTO Michael Jenkins.
“Until every system is patched, controls that limit what a web-facing process can launch, access, or connect to can reduce an attacker’s options. Those controls are a backstop, not a substitute for patching, and should remain in place afterward. A PHP process generally needs access only to the files and network services required to run the site. Restricting everything else can help prevent a compromised web server from becoming a gateway into the broader business,” Jenkins added.
According to Forescout threat hunting senior manager Sai Molige and Expel principal threat researcher (and former hacker) Marcus Hutchins, PHP2Shell is comparable to Log4Shell.
“PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason. With Log4j, the main problem was finding a library you didn’t know you had. With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix. The durable lesson from Log4j is that organizations should treat ‘How quickly can we identify where we run X?’ as a measurable capability separate from patching speed,” Molige said.
“I’d say PHP2Shell is like 50% the way towards Log4J. Massive wide-ranging impact. Worse direct exploitation. Shorter tail & indirect exploitation due to not being as deeply embedded in 3rd party software as Log4J was,” Hutchins said.
Related: Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Related: Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Related: ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Related: Context Is King in the Fight Against Modern Cyberattacks
Written By Ionut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Ahold Delhaize Restoring Services Disrupted by Cyberattack AI Platform Cairn Abused to Hack Over 100 Organizations Hackers Steal 1.8 Million Records From Nikkei Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Latest News
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
US Agencies Detail Incident Response Practices for Rogue AI Agents
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)