PHP2Shell Exploitation Prompts CISA Deadline as Researchers Report Firewall Compromises
CISA added CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The pre-authentication PHP remote code execution flaws carry CVSS v4.0 scores of 9.2. Federal civilian agencies must remediate by October 29 and perform forensic triage; the PHP Foundation has released four patched versions. Cloudflare reported millions of exploitation attempts, while Ox Security found 93.6% of assessed instances remained exposed five days after disclosure, although version-based estimates can miss backported fixes. Praetorian demonstrated exploitation against Apache with mod_php but found reliability highly dependent on configuration, build and memory layout, cautioning against comparisons with uniform, internet-wide Log4Shell exploitation; it had not validated the separate PHP-FPM path. Dream researchers reported an operation chaining PHP2Shell with the Fragnesia Linux kernel vulnerability to gain root access on 24 perimeter firewalls and an internal management server running an undisclosed vendor’s software. In one US government-affiliated environment, attackers established persistent tunnels, stole credentials and private keys, and enumerated Active Directory. Researchers cited possible Chinese links, while a separate Cyfirma report described scanning by suspected North Korean operators; neither attribution is conclusive. Organizations should prioritize internet-facing PHP services and PHP-based appliance management interfaces, verify vendor-specific exposure and fixes, remove publicly exposed phpinfo pages, and investigate signs of compromise. The NSA advised taking affected systems offline when immediate mitigation is not feasible.. Fonte: https://mallory.ai/stories/01a17f0b-b539-775a-a267-3d232e1d5e73
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.