Texnologiya sotuvchilari, kiberxavfsizlik kompaniyalari va davlat idoralari PHP2Shell zaifliklari bo'yicha maslahatlar, aniqlash vositalari va yumshatish choralarini e'lon qildi, shu bilan birga ko'plab dasturiy ta'minot ishlab chiqaruvchilari o'z mahsulotlari ta'sirga uchragan-uchramaganini hali tekshirmoqda.
Ikki muhim xato — CVE-2026-109618 va CVE-2026-109619 — autentifikatsiyasiz hujumchilarga masofadan kod bajarish imkonini beradi. Wiz, OpenAI va Calif ularni avgust oyida aniqladi, PHP esa 21-oktabrda 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalari bilan tuzatdi.
PHP relizni rejalashtirilgan oshkor qilishdan bir kun oldin e'lon qildi, chunki CVE identifikatorlari 20-oktabrda internetda tarqala boshladi.
Amazonning aytishicha, birinchi ekspluatatsiya urinishlari 17-oktabrda, embargo bekor qilinishidan oldin sodir bo'lgan. Hadrian, Patchstack va Cloudflare barchasi tuzatishlar e'lon qilinishidan oldingi soatlarda hujum urinishlarini aniqladi. WatchTowr tuzatishlar e'lon qilingandan so'ng tezda keng tarqalgan ekspluatatsiyani kuzatdi, garchi tarqalgan PoC ekspluatlari kod bajarishga erishmagan bo'lsa-da.
PHP keng turdagi tijorat dasturiy ta'minot, qurilmalar va bulut xizmatlariga o'rnatilganligi sababli, butun soha bo'ylab kompaniyalar o'z ta'sirini tekshirishga majbur bo'ldi.
Texnologiya sotuvchilari mahsulotlarni tekshirmoqda, PHP ish vaqti muhitlarini yangilamoqda
Cisco'ning maslahati 30 dan ortiq mahsulot va bulut xizmatlarini tekshirish ostida ekanligini ko'rsatadi. Ular orasida Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex va AppDynamics PHP Agent bor. "Hozircha hech bir mahsulot ta'sirga uchragani ma'lum emas", deb aytadi Cisco. Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Cisco Talos PHP2Shell uchun Snort qamrovini, jumladan Community Ruleset qoidalarini bayon qildi. Ochiq manba ma'lumotlariga asoslanib, tahdid razvedkasi bo'limi PHP tizimlarining taxminan yarmi tuzatish olmasligini taxmin qiladi va PHP 8.1 yoki undan oldingi versiyalarda ishlaydigan har kimni darhol 8.2 yoki yangiroq versiyaga o'tishga chaqiradi.
Red Hat bahosi NVD bahosidan kamroq jiddiy: u ikkala xatoni 8.1 deb baholaydi, 9.8 emas, va ularni muhim deb hisoblamaydi. CVE-2026-109618 haqida u "ishonchli ekspluatatsiya aniq heap manipulyatsiyasi va vaqtni talab qiladi" deb aytadi va "masofadan kod bajarish amalda qiyin va odatda standart bo'lmagan xatti-harakatni talab qiladi" deb ta'kidlaydi.
21-oktabrda Ubuntu barcha qo'llab-quvvatlanadigan relizlari uchun tuzatishlarni e'lon qildi, Debian esa bookworm va trixie relizlarida kamchiliklarni bartaraf etdi.
AWS PHP2Shell zaifliklarini Elastic Beanstalk, WorkMail, Amazon Linux va Amazon Lightsail'da bartaraf etmoqda.
Google Cloud o'zi zaif emas, lekin App Engine standart muhitidagi qo'llab-quvvatlanadigan PHP ish vaqti muhitlari avtomatik ravishda yangilandi va kompaniyaning serverless PHP xizmatlari uchun yangi asosiy tasvirlar tarqatilmoqda.
Xosting boshqaruv panellari orasida cPanel, Plesk va DirectAdmin tuzatishlarni e'lon qildi. cPanel va Plesk shuningdek, hayot tsikli tugagan PHP 7.4, 8.0 va 8.1 tarmoqlari uchun tuzatilgan qurilmalarni e'lon qildi.
SolarWinds o'z mahsulotlari va internetga ochiq aktivlarini tekshirganini aytadi. "Pingdom PHP'dan foydalanadi, lekin biz mahsulotni himoya qilish uchun kompensatsiya nazoratlarini joriy etdik", deb aytadi kompaniya. U o'zining PHP asosidagi tashqi veb-sayti uchun ham xuddi shunday yondashuvni qo'llagan va mijozlar hech narsa qilishlari shart emasligini aytadi.
Xavfsizlik firmalari aniqlash va yumshatish choralarini joriy etmoqda
Palo Alto Networks yaqinlashib kelayotgan PAN-OS relizlari muammoni hal qilishini aytadi va mijozlar uchun vaqtinchalik yechimlar va yumshatish choralarini ulashdi. Kompaniya o'z mahsulotlariga ta'sirni yuqori jiddiylik deb hisoblaydi, CVSS balli 8.7, va ularga qarshi hujumlar haqida hech qanday ma'lumot yo'qligini aytadi.
Fortinet 24 ta mahsuloti, jumladan FortiOS, FortiManager, FortiAnalyzer va FortiWeb, ta'sirga uchramaganini tasdiqladi. U hali bir nechta boshqalarini tekshirmoqda.
Sophos o'zining MyUTM portali, hayot tsikli tugagan SG UTM mahsuloti uchun u joylashtirgan eski litsenziyalash xizmati, zaif PHP versiyasini ishlatayotganini aniqladi. Kompaniya portalni 21-oktabrda oflayn qildi va uni qayta ishga tushirishdan oldin yangilamoqda.
Broadcom o'zining Enterprise Security Group mahsulotlaridan hech biri ta'sirga uchraganini tasdiqlamaganini aytadi. Uning Symantec va Carbon Black takliflari xatti-harakatga asoslangan imzolar, bog'liq xakerlik vositalari uchun faylga asoslangan aniqlash va PHP2Shell hujumlari bilan bog'liq faoliyatni aniqlash uchun to'rtta ilova nazorat qoidalarini taqdim etadi.
CrowdStrike sinov orqali bitta autentifikatsiyasiz POST so'rovi Apache mod_php ishchisini shell ishga tushirish va hujumchi tanlagan buyruqni bajarish uchun yetarli ekanligini tasdiqladi, bunda zaif ilova kodi talab qilinmaydi. U Falcon Next-Gen SIEM'ga PHP2Shell aniqlash mazmunini qo'shdi.
Kiber sug'urta kompaniyasi Coalition 20-oktabrda, ommaviy oshkor qilishdan oldin, zaif PHP versiyalarini ishlatayotganini bilgan ba'zi sug'urta egalariga xabar berdi. 20 va 21-oktabr orasida uning honeypotlari kamchiliklarni ekspluatatsiya qilish uchun ishlatiladigan naqshlarga mos keladigan so'rovlarni qayd etdi.
Muvofiqlashtirilgan javobda ishtirok etgan tashkilotlardan biri Corelight, oshkor qilishdan oldin Zeek va Suricata aniqlashlarini yaratdi va ularni ochiq manba sifatida taqdim etdi.
Qualys ta'sirga uchragan xostlarda PHP'ning session upload-progress funksiyasini o'chiradigan yumshatish choralarini joriy etdi va JFrog oshkor qilish vaqti atrofida soxta PoC'lar paydo bo'lganini ogohlantirdi.
Datadog, Endor Labs, Huntress, Patchstack, Recorded Future, Sansec, SOCRadar va Tenable ham texnik tahlillar va tuzatish maslahatlarini e'lon qildi.
Hukumatlar yashirin PHP haqida ogohlantirmoqda, saytlarni oflayn qilmoqda
CISA tashkilotlarni darhol tuzatish boshlashga, internetga ochiq tizimlardan boshlashga chaqirdi va PHP tez-tez boshqa dasturiy ta'minot ichiga o'rnatilganligi, shuning uchun uning mavjudligi aniq bo'lmasligi mumkinligi haqida ogohlantirdi.
Buyuk Britaniyaning NCSC kashfiyot harakatlari har bir PHP o'rnatilishini, faqat eskirganlarini emas, qamrab olishi va tashkilotlar PHP bilan ishlaydigan qurilmalar va xizmatlar sotuvchilaridan yangilanishlarni kuzatib borishi kerakligini aytadi. U shuningdek, tuzatishlar yoki yumshatish choralaridan oldin hujumchilar joylashtirgan orqa eshiklarni qidirishni tavsiya qiladi.
Niderlandiyaning NCSC PHP'ga bog'liq bo'lishi mumkin bo'lgan dasturiy ta'minotni jamoat GitHub omborida kuzatmoqda.
CERT-EU tashkilotlarni kechiktirmasdan yangilashga va tuzatish qo'llanilib tekshirilguncha internetga ochiq ilovalarni izolyatsiya qilishga chaqiradi. Yevropa Komissiyasi, ENISA, Europol va milliy hodisa javob jamoalari tarmog'i bilan birgalikda bergan bayonotida u mahsulotlar PHP orqa fonda ishlaganda va aniq ishlatilmaganda ham zaif bo'lishi mumkinligi haqida ogohlantirdi.
Kanadaning Kiber Markazi va Germaniyaning BSI ham ogohlantirishlar e'lon qildi, ikkalasi ham tashkilotlarni yangilanishlarni kechiktirmasdan o'rnatishga chaqirdi.
Ba'zi tashkilotlar ta'sirga uchragan holda qolishdan ko'ra oflayn bo'lishni tanladi. Reuters ma'lumotiga ko'ra, Yevropadagi bir nechta hukumat, maktab va shifoxona veb-saytlari 21-oktabrda yopildi.
Bog'liq: "Kontekst bombalari" AI hujum muvaffaqiyatini soxta maqsadlar bilan agentlarni chalg'itish orqali kamaytirmoqda
Bog'liq: Yuqori jiddiylikdagi kamchiliklar uch kunda ekspluatatsiya qilindi, ransomware Q3'da hukmronlik qildi: Rapid7
Tech vendors, cybersecurity companies and government agencies have published advisories, detections and mitigations for the PHP2Shell vulnerabilities, while many software makers are still checking whether their own products are exposed.
The two critical bugs, CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers execute code remotely. Wiz, OpenAI and Calif identified them in August, and PHP addressed them on October 21 with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
PHP pushed out the release one day ahead of the planned disclosure, after the CVE identifiers started circulating online on October 20.
Amazon says the first exploitation attempt came on October 17, before the embargo lifted. Hadrian, Patchstack and Cloudflare all detected attack attempts in the hours leading up to the patches. WatchTowr saw mass exploitation soon after the fixes were published, although the PoC exploits in circulation did not achieve code execution.
With PHP built into a wide range of commercial software, appliances and cloud services, companies across the industry have had to check their exposure.
Tech vendors check products, update PHP runtimes
Cisco’s advisory names over 30 products and cloud services under review. Among them are Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Webex and the AppDynamics PHP Agent. “Currently, no products are known to be affected,” Cisco says.Advertisement. Scroll to continue reading.
Cisco Talos has outlined the Snort coverage for PHP2Shell, including Community Ruleset rules. Based on open source data, the threat intelligence unit estimates that about half of PHP systems won’t get a patch, and it urges anyone on PHP 8.1 or earlier to move to version 8.2 or newer right away.
Red Hat’s assessment is less severe than NVD’s: it scores both bugs 8.1, compared with 9.8, and doesn’t rate them critical. Regarding CVE-2026-109618, it says that “reliable exploitation requires precise heap manipulation and timing” and notes that “remote code execution is difficult in practice and typically requires non-default behavior”.
On October 21, Ubuntu shipped fixes for all its supported releases, and Debian addressed the flaws in its bookworm and trixie releases.
AWS is addressing the PHP2Shell vulnerabilities in Elastic Beanstalk, WorkMail, Amazon Linux, and Amazon Lightsail.
Google Cloud itself is not vulnerable, but supported PHP runtimes in the App Engine standard environment were updated automatically, and new base images are being rolled out for the company’s serverless PHP services.
Among hosting control panels, cPanel, Plesk and DirectAdmin shipped patches. cPanel and Plesk also released fixed builds for the end-of-life PHP 7.4, 8.0 and 8.1 branches.
SolarWinds says it has reviewed its products and internet-facing assets. “Pingdom uses PHP, but we have implemented compensating controls to protect the product,” the company says. It has taken the same approach for its PHP-based external website and says customers don’t need to do anything.
Security firms roll out detections and mitigations
Palo Alto Networks says upcoming PAN-OS releases will address the issue, and it has shared workarounds and mitigations for customers to apply in the meantime. The company considers the impact on its products high severity, with a CVSS score of 8.7, and says it has no knowledge of attacks against them.
Fortinet has confirmed that two dozen of its products, including FortiOS, FortiManager, FortiAnalyzer and FortiWeb, are not impacted. It is still investigating several others.
Sophos found that its MyUTM portal, a legacy licensing service it hosts for the end-of-life SG UTM product, was running a vulnerable PHP version. The company took the portal offline on October 21 and is updating it before bringing it back.
Broadcom says it has not confirmed any of its Enterprise Security Group products as affected. Its Symantec and Carbon Black offerings provide behavior-based signatures, a file-based detection for related hacking tools, and four application control rules for spotting activity potentially tied to PHP2Shell attacks.
CrowdStrike says it confirmed through testing that one unauthenticated POST request is enough to make an Apache mod_php worker start a shell and execute a command chosen by the attacker, with no vulnerable application code required. It has added PHP2Shell detection content to Falcon Next-Gen SIEM.
Cyber insurer Coalition says it notified some policyholders it knew were running vulnerable PHP versions on October 20, ahead of public disclosure. Between October 20 and 21, its honeypots logged requests matching the patterns used to exploit the flaws.
Corelight, one of the organizations involved in the coordinated response, created Zeek and Suricata detections ahead of disclosure and made them available as open source.
Qualys rolled out a mitigation that switches off PHP’s session upload-progress feature on affected hosts, and JFrog cautioned that fake PoCs appeared around the time of disclosure.
Datadog, Endor Labs, Huntress, Patchstack, Recorded Future, Sansec, SOCRadar and Tenable have also published technical analyses and remediation advice.
Governments warn of hidden PHP, take sites offline
CISA called on organizations to patch right away, starting with internet-facing systems, and cautioned that PHP is frequently embedded in other software, so its presence may not be obvious.
The UK’s NCSC says discovery efforts should cover every PHP installation, not just outdated ones, and that organizations should keep an eye out for updates from vendors of appliances and services that may ship with PHP. It also recommends hunting for backdoors that attackers may have planted before patches or mitigations were applied.
The Dutch NCSC is tracking potentially affected software that depends on PHP in a public GitHub repository.
CERT-EU urges organizations to update without delay and to isolate internet-facing applications until the fix has been applied and verified. In a joint statement with the European Commission, ENISA, Europol and the EU’s network of national incident response teams, it warned that products may be vulnerable even when PHP runs behind the scenes and isn’t obviously in use.
Canada’s Cyber Centre and Germany’s BSI have also issued alerts, both urging organizations to install the updates without delay.
Some organizations chose to go offline rather than stay exposed. According to Reuters, several government, school and hospital websites in Europe were taken down on October 21.
Related: ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Related: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Written By Eduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure One Compromised Login Exposed Millions of California Students’ Records
Latest News
Splunk, SolarWinds Release Fresh Security Updates Cisco Patches 34 Vulnerabilities Across Multiple Products PHP2Shell Exploitation Started Days Before Patches Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
US Agencies Detail Incident Response Practices for Rogue AI Agents
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)