Ikki muhim PHP zaifliklarini nishonga olgan ommaviy proof-of-concept eksploit kodi paydo bo'ldi, hujumchilar esa ochiq serverlarni skanerlash va eksploitatsiya urinishlarini boshladilar.
CVE-2026-109618 va CVE-2026-109619 sifatida kuzatilgan zaifliklar birgalikda PHP2Shell deb ataladi va CVSS v4.0 bo'yicha 9.2 ballga ega bo'lib, autentifikatsiyasiz masofaviy kod bajarish (RCE) imkoniyatini web-server huquqlari bilan taqdim etishi mumkin.
Biroq Sophos avvalgi muvaffaqiyatli eksploitatsiya haqidagi hisobotni tuzatdi. Uning 22-oktabrda 21:21 UTC da e'lon qilingan yangilanishida aytilishicha, mijoz telemetriyasi skanerlash va oz sonli muvaffaqiyatsiz urinishlarni ko'rsatgan, tasdiqlangan buzilishlar emas.
Bu aniqlashtirish kompaniyaning 16:18 UTC dagi bahosini bekor qiladi va kuzatilgan faoliyatni talqin qilish usulini tubdan o'zgartiradi.
Har ikkala zaiflik ma'lum bir ilovaga emas, PHP ning o'ziga taalluqli, shuning uchun zaif PHP runtime'larini o'z ichiga olgan veb-saytlar, xizmatlar va mahsulotlar bo'ylab ta'sir doirasi keng.
PHP 21-oktabrda 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalarida tuzatishlarni e'lon qildi. mod_php dan foydalanadigan Apache o'rnatmalari eng yuqori xavf ostida, garchi PHP-FPM, php-cgi, FrankenPHP va LiteSpeed o'rnatmalari ham ta'sirlangan.
Administratorlar tegishli yuqori darajadagi relizni yoki ekvivalent vendor paketini olishlari shart; bu yangilanishlar avtomatik o'rnatilmaydi.
Sophos tadqiqotchilari aytishicha, CVE-2026-109618 xotira buzilishi bilan bog'liq bo'lib, xotira tugashi (out-of-memory) bilan bog'liq, CVE-2026-109619 esa eskirgan so'rov holati va foydalanishdan keyin foydalanish (use-after-free) sharoitlari bilan bog'liq.
Ommaviy eksploit mavjudligi ishonchli eksploitatsiyani isbotlamaydi. Sophos aytishicha, uning Adversary Group hatto AI yordamida ham muvaffaqiyatli eksploit ishlab chiqa olmadi.
Tadqiqotchilar muvaffaqiyatlari laboratoriya sharoitlari, o'rnatish arxitekturasi, maxsus konfiguratsiyalar yoki ishlab chiqarish muhitiga izchil o'tmaydigan qo'shimcha bog'liqliklarga bog'liq bo'lishi mumkin.
Bloklangan faoliyat Potassium deb baholangan yukni o'z ichiga olgan, bu ehtimol Mirai dan kelib chiqqan botnet varianti. Sophos ta'kidlashicha, zararli dastur yetkazilmagan, chunki uning qarshi choralar eksploitatsiya urinishini to'xtatgan.
Shunga qaramay, tahlil 2026-yil boshida hujjatlashtirilgan variantning yangilangan, sezilarli darajada kengaytirilgan versiyasini aniqladi.
Namuna yuklab oluvchi funksionallikni tarmoqni buzish qobiliyatlari bilan birlashtiradi. U qattiq kodlangan, shifrlangan buyruq-va-nazorat manzilini yechadi, 134[.]199[.]154[.]64 ga TCP ulanish ochadi va HTTP so'rov yuboradi.
Olingan kontentni qabul qilishdan oldin, u HTTP 200 javobini va ELF sehrli baytlarini 7F 45 4C 46 tekshiradi, bu kutilgan Linux bajariladigan faylini ko'rsatadi.
Uning resolveri IPv4 manzillarini va host nomlarini qo'llab-quvvatlaydi, zaxira mantiqi esa ommaviy DNS xizmatlari 8.8.8.8, 1.1.1.1 va 1.0.0.1 ga murojaat qiladi. Bu qonuniy resolverlar o'zlari zararli ko'rsatkichlar emas.
Oldingi Mirai variantlari singari, namuna tarqatilgan xizmatni rad etish (DDoS) hujumlarini amalga oshirishi mumkin. Sophos shuningdek 117[.]55[.]202[.]115 ni Potassium buyruq-va-nazorat infratuzilmasi bilan bog'ladi.
Sophos Firewall IPS imzolarini 67359, 67360, 67375, 2313184, 2313185, 2313187 va 2313188 sifatida e'lon qildi. Endpoint IPS qamrovi 2313184, 2313185, 2313187, 2313188 va 2313189 ni o'z ichiga oladi.
Bu himoyalar mavjud endpoint XDR, Taegis XDR, Windows Behavioral Protection va Linux Runtime Detection qoidalarini to'ldiradi, lekin patchlashni almashtirmaydi.
Himoyachilar kutilmagan ko'p qismli yuklash so'rovlarini, xotira tugashi xatolarini, ishchi jarayonlarining ishdan chiqishini, shubhali bolalar jarayonlarini, o'zgartirilgan PHP fayllarini va g'ayrioddiy tashqi ulanishlarni tekshirishlari kerak.
Darhol patchlash mumkin bo'lmaganda, Sophos ochiq ilovalarni internetdan vaqtincha olib tashlash yoki ularni tarmoq darajasidagi autentifikatsiya orqasiga joylashtirishni tavsiya qiladi.
Konfiguratsiya yumshatishlari alohida hujum yo'llarini hal qiladi, zaifliklarni butunlay bartaraf etmaydi.
Tashkilotlar faol PHP runtime'larini, jumladan qurilmalar va xosting xizmatlari bilan birga kelgan nusxalarni inventarizatsiya qilishlari va vendor tuzatish holatini tekshirishlari kerak.
Sophos telemetriyasida tasdiqlangan buzilishning yo'qligi yangilanishlarni kechiktirmasligi kerak: zaifliklar hali ham muhim, va tadqiqot davom etar ekan, hujumchilar eksploit ishonchliligini yaxshilashlari mumkin.
Public proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation.
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4.0 scores of 9.2, potentially allowing unauthenticated remote code execution with web server privileges.
However, Sophos has corrected an earlier report of successful exploitation. Its October 22 update, published at 21:21 UTC, states that customer telemetry showed scanning and a small number of failed attempts, not confirmed compromises.
The clarification supersedes the company’s 16:18 UTC assessment and materially changes how the observed activity should be interpreted.
Both affect PHP itself rather than a particular application, making the exposure relevant across websites, services, and products embedding vulnerable PHP runtimes.
PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Apache deployments using mod_php face the highest risk, although PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments are also affected.
Administrators must obtain the appropriate upstream release or equivalent vendor package; these updates are not installed automatically.
Sophos Researchers said that, CVE-2026-109618 involves memory corruption associated with out-of-memory handling, while CVE-2026-109619 involves stale request state and use-after-free conditions.
Public exploit availability does not establish reliable exploitation. Sophos said its Adversary Group struggled to develop a successful exploit even with AI assistance.
Claimed researcher successes may depend on laboratory conditions, deployment architecture, specific configurations, or additional dependencies that do not translate consistently into production environments.
The blocked activity involved a payload assessed as Potassium, a likely Mirai-derived botnet variant. Sophos emphasized that the malware was not delivered because its countermeasures prevented the exploitation attempt.
Analysis nevertheless identified an updated, significantly expanded version of the variant documented earlier in 2026.
The sample combines downloader functionality with network disruption capabilities. It resolves a hard-coded, encrypted command-and-control address, opens a TCP connection to 134[.]199[.]154[.]64, and sends an HTTP request.
Before accepting the retrieved content, it checks for an HTTP 200 response and the ELF magic bytes 7F 45 4C 46, indicating an expected Linux executable.
Its resolver supports IPv4 addresses and hostnames, with fallback logic referencing public DNS services 8.8.8.8, 1.1.1.1, and 1.0.0.1. These legitimate resolvers are not malicious indicators themselves.
Like earlier Mirai variants, the sample can conduct distributed denial-of-service attacks. Sophos also associated 117[.]55[.]202[.]115 with Potassium command-and-control infrastructure.
Sophos released Firewall IPS signatures 67359, 67360, 67375, 2313184, 2313185, 2313187, and 2313188. Endpoint IPS coverage includes 2313184, 2313185, 2313187, 2313188, and 2313189.
These protections supplement existing endpoint XDR, Taegis XDR, Windows Behavioral Protection, and Linux Runtime Detection rules, but do not replace patching.
Defenders should examine unexpected multipart upload requests, memory-exhaustion errors, worker crashes, suspicious child processes, modified PHP files, and unusual outbound connections.
When immediate patching isn’t possible, Sophos recommends temporarily removing exposed applications from the internet or placing them behind network-layer authentication.
Configuration mitigations address individual attack paths rather than eliminating the vulnerabilities.
Organizations should inventory active PHP runtimes, including copies bundled with appliances and hosted services, and verify vendor remediation status.
The absence of confirmed compromise in Sophos telemetry should not delay updates: the vulnerabilities remain critical, and attackers may improve exploit reliability as research continues.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.