轻之舟百科

PHP2Shell

Template:Short description Template:Current Template:Use Canadian English Template:Use dmy dates

PHP2Shell
CaelLab's instance as seen hours before the patch, having been disabled as a precaution
[[CVE (identifier)|CVE identifierTemplate:Pluralize from text]]Template:CVE
Template:CVE
Date discoveredTemplate:Start date and age
Date patchedTemplate:Start date and age
DiscovererCalif, OpenAI, Wiz
Affected softwarePHP versions 5.4–8.5[1]

PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618[2] and CVE-2026-109619[3]) in PHP versions 5.4Template:Endash8.5 that allow remote code execution (RCE). Their existence was publicly announced on 20 October 2026.[4] An emergency patch for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.[5]

Discovery

編輯

PHP versions as early as 5.4 (released in 2012)[6] are affected by these vulnerabilities, and while concerns around memory safety bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working exploit could be feasible.[7][8] A PHP core developer discovered the out-of-memory error behind one of the vulnerabilities during an audit in 2024, but the bug was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.[9][10]

The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the California-based[11] security firm Calif, as part of the OpenAI "Patch the Planet" project in August 2026, and the Israeli–American cloud security company Wiz, a subsidiary of Alphabet Inc. and a part of Google Cloud.[8] Austin used OpenAI's GPT-5.6 Sol model to assist with finding the vulnerability.[8] Wiz researchers used the large language models Gemini 4 Argon and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.[12]

The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers,[13] while security firm watchTowr rated it a full 10.0.[14]

Patches

編輯

The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).[5] Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered end of life.[5] Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice.[5] Both vulnerabilities were published through GitHub security advisories on 21 October 2026 at 13:34 UTC,[15][16] 26 minutes before the announced release time, with the PHP website updated shortly thereafter.[17]

The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the Hacker News forums,[18] in a post on X by cybersecurity company watchTowr labs, and in a proof-of-concept exploit video mistakenly released by Calif.[19]Template:Unreliable source?[8][9] The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.[5] One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".[20] Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the Internet before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.[14][21][9]

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure.[22] Cloudflare reported signs of early exploitation prior to public patch release, and deployed temporary web application firewall (WAF) rules as an attempted stopgap mitigation against the vulnerability.[23][24][25] Security firm watchTowr said it had observed exploitation in the wild by 21 October through its honeypot network,[26] while the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation as of the same day.[27]

Impact

編輯
File:Php2shell wiki.png
Warning posted on the English Wikipedia about community-owned tools being offline due to the PHP2Shell incident.

Approximately 69% of websites use PHP, including those that use content management systems such as Drupal, Joomla, and WordPress, so the potential impacts were widespread.[27][28] PHP is also bundled with vendor appliances, web host control panels such as cPanel and Plesk, and some Windows applications.[29]

Following advice from CERT-EU and the British National Cyber Security Centre, many organizations across Europe took their websites offline as a precaution while the patches were pending, including the Dutch government portal Overheid.nl, the Danish national school communication platform, all Finnish government public-facing web services, and all websites of the French Interior Ministry.[12][28][30][31] The US National Security Agency recommended that websites go offline if unable to update immediately.[7][32] The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of backdoors.[33] The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.[34]

The Wikimedia Foundation shut down many of their supporting services, and forum sites 4chan and Something Awful went offline.[27][35][7] Parts of the Japanese internet also went offline, including games such as Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, and numerous online commerce sites.[34][35] The Internet Archive briefly shut down to fix the issue.[36]

Analysis

編輯

Researchers at Wiz stated that the issue was on par with Heartbleed, a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time.[37] Commentary in The Guardian noted that the PHP Foundation, which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.[38] Coverage in The New York Times said that PHP was "pervasive" and speculated that "everyday users" could have their personal data put at risk.[39]

See also

編輯

References

編輯
  1. ↑ PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog. wiz.io. 21 October 2026 （en-us）. 
  2. ↑ CVE-2026-109618. Mitre. 
  3. ↑ CVE-2026-109619. Mitre. 
  4. ↑ PHP: News Archive - 20 Oct 2026. www.php.net. 20 October 2026 [21 October 2026] （English）. 
  5. ↑ 5.0 5.1 5.2 5.3 5.4 PHP: News Archive - 21 Oct 2026. www.php.net. 21 October 2026 [21 October 2026] （English）. 
  6. ↑ PHP: Releases. www.php.net. [22 October 2026] （English）. 
  7. ↑ 7.0 7.1 7.2 Kan, Michael. This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says. PCMAG. 21 October 2026 [21 October 2026] （English）. 
  8. ↑ 8.0 8.1 8.2 8.3 McMillan, Robert. Exclusive | AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk需要付費訂閱. Wall Street Journal. 21 October 2026 [21 October 2026].  已忽略未知參數|url-access= (幫助) 引用錯誤：<ref>標籤內有無效參數"details"。有支援的參數是：dir, follow, group, name。
  9. ↑ 9.0 9.1 9.2 Constantin, Ana Maria. PHP knew about one of the flaws in 2024 but could not agree a fix. The Next Web. 21 October 2026 [21 October 2026]. 
  10. ↑ Today's PHP Security Release, and How We're Strengthening PHP Security. thephp.foundation. [21 October 2026] （English）. 
  11. ↑ Volz, Dustin. A Hacking Tool Built With A.I. Can Breach Phones Without a Click. The New York Times. 8 September 2026 [21 October 2026]. 
  12. ↑ 12.0 12.1 Satter, Raphael; Marchandon, Leo; Ghosh, Kanjyik; Pardesi, Rajveer. Government websites go dark after AI-discovered flaw sparks security scramble. Reuters. 21 October 2026 [21 October 2026] （English）. 
  13. ↑ php.announce: [ANNOUNCE] Upcoming Critical PHP Security Release. news-web.php.net. [21 October 2026]. 
  14. ↑ 14.0 14.1 Abrams, Lawrence. PHP warns admins of two critical flaws, emergency patches coming tomorrow. BleepingComputer. [21 October 2026] （en-us）. 
  15. ↑ RCE via OOM corruption. 21 October 2026 [21 October 2026]. 
  16. ↑ RCE via stale global state. 21 October 2026 [21 October 2026]. 
  17. ↑ Scherzer, Daniel. Blog: PHP2Shell: a Timeline. scherzer.dev. 22 October 2026 [22 October 2026] （English）. 
  18. ↑ Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming. news.ycombinator.com. [22 October 2026]. （原始內容存檔於21 October 2026） （English）. 
  19. ↑ Khandelwal, Swati. PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert. The Hacker News. 21 October 2026 [21 October 2026] （English）. 
  20. ↑ Goodin, Dan. PHP warns it plans to release 2 emergency patches imminently. Ars Technica. 20 October 2026 [21 October 2026]. （原始內容存檔於21 October 2026） （English）. 
  21. ↑ Only for the curious.... jackalsyn.com. [21 October 2026]. 
  22. ↑ Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog. aws.amazon.com. 21 October 2026 [22 October 2026]. 
  23. ↑ Gatlan, Sergiu. PHP ships emergency patches for critical PHP2Shell flaws. BleepingComputer. 21 October 2026 [21 October 2026] （en-us）. 
  24. ↑ Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits. PC Gamer. 21 October 2026 [21 October 2026] （English）. 
  25. ↑ Knecht, Dane. Dane Knecht 🦭 (@dok2001) on X. X (formerly Twitter). 21 October 2026. 
  26. ↑ PHP RCE FAQ: PHP2Shell CVE-2026-109618 & CVE-2026-109619. watchTowr. 20 October 2026 [21 October 2026] （English）. 
  27. ↑ 27.0 27.1 27.2 Collier, Kevin. Critical vulnerabilities in commonly used web code spark rush to update systems. NBC News. 21 October 2026 [21 October 2026] （English）. 
  28. ↑ 28.0 28.1 Gerkin, Tom. Websites taken down worldwide as critical PHP cyber-security update issued. BBC News. 21 October 2026 [21 October 2026]. 
  29. ↑ Hammond, John. Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619). Huntress. 21 October 2026 [21 October 2026] （English）. 
  30. ↑ Van Dessel, Josse. Major websites go offline as critical PHP vulnerability triggers security fears. The Brussels Times. 21 October 2026 [21 October 2026] （English）. 
  31. ↑ Template:Cite press release
  32. ↑ NSA Advisory: PHP Updates. NSA Press Room. 21 October 2026 [21 October 2026]. Effective immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. 
  33. ↑ Booth, Robert; Down, Aisha. Flaw in PHP computer language leads to shutdown of websites around world. The Guardian. 21 October 2026 [21 October 2026]. 
  34. ↑ 34.0 34.1 著名ITサービス相次いで緊急メンテへ　コドモン、シャドバ、BASE、さくらのレンタルサーバなど　「PHP」脆弱性に起因か [Several prominent IT services—including Codmon, Shadowverse, BASE, and Sakura Rental Server—have initiated emergency maintenance, likely due to a vulnerability in PHP]. ITmedia. 21 October 2026 [21 October 2026] （日本語）. 
  35. ↑ 35.0 35.1 Tauber, Olivia. PHP vulnerability: Which websites and services are affected?. Mashable. 21 October 2026 [21 October 2026] （English）. 
  36. ↑ Smith, Paul; Mizen, Ronald. AI just discovered a bug putting 70pc of world's websites at risk. Australian Financial Review. 21 October 2026 [22 October 2026] （English）. 
  37. ↑ Eadicicco, Lisa. Global websites shut down after AI found a critical flaw affecting 70% of the internet | CNN Business. CNN. 21 October 2026 [22 October 2026] （English）. 
  38. ↑ Taylor, Josh. What is PHP, and how bad is the computer language flaw causing website shutdowns globally?. The Guardian. 22 October 2026 [22 October 2026]. 
  39. ↑ Adam, Karla; Volz, Dustin. What Is PHP? Why Are Government and Business Websites Going Offline?. The New York Times. 22 October 2026 [22 October 2026]. ISSN 0362-4331 （en-US）. 
編輯

Template:Hacking in the 2020s

取自 "https://130.wiki/index.php?title=PHP2Shell&oldid=14160"