PHP2Shell Security Flaws Now Successfully Exploited (bleepingcomputer.com) 29
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.
"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.
"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.
Thank goodness (Score:5, Funny)
Thank goodness that languages like C, C++, Javascript, Python, and C# are all still completely safe.
Re: (Score:3)
Somebody get this guy ^^^ a fucking humor injection, STAT!!
Re: (Score:3, Insightful)
Re: (Score:2)
Gee... running everything on open-source software, where the code can be downloaded and modified to do literally anything, and then stuffed into an update is a bad thing? I would've never guessed that.
AI just made finding holes a thousand time faster, and my guess is, it won't stop until the user is declared a bug, or even the machine being used/accessed is a bug.
Re: (Score:1)
The problem is the weakest link: humans.
Re: (Score:3)
You're the kind of guy who rotates the square piece in Tetris.
Re: (Score:3)
The PHP interpreter being exploited was written in C and C++.
Re: (Score:2)
The PHP interpreter being exploited was written in C and C++.
And? As I said, the problem is not the language, C / C++, the problem is who wrote it: humans. If the C code is well written, the compiler makes a safe binary code.
Re:Thank goodness (Score:4, Interesting)
I think we should rewrite everything in Rust and then sprinkle unsafe() around like it was glitter to get most things to work, and then claim it's more secure because "Hey, at least we put warning cones out around the dangerous bits!"...
AI Company Hypes AI-Discovered CVE. News at 11! (Score:3, Insightful)
Re: AI Company Hypes AI-Discovered CVE. News at 11 (Score:1)
Re: (Score:2)
"Why is this one getting such breathless coverage?"
It requires nothing from the targeted site other that it have PHP with one particular setting remaining set to the default. The site PHP code doesn't matter.
mod_php was considered the easiest approach (Score:5, Interesting)
Re: (Score:2)
If you're on EL9, mod_php is a lot more work to get set up, so imagine a lot of people moved from mod_php to php-fpm when moving to EL9. And if you're running php-fpm on EL9, you may as well reconfigure EL8 to work that way as well for consistency. EL7 and older didn't have php-fpm, and would require you to roll your own patched PHP as they're out of support.
Re:mod_php was considered the easiest approach (Score:5, Insightful)
This appears to be an FPM exploit: https://github.com/KillaBoi/St... [github.com]
But notice it has to make a huge amount of assumptions about the configuration of the server in order to work. So this kinda sorta underlines the thing you say, assuming the hacker cannot obtain the output of php_info() - it's not unheard of for PHP devs to include that somewhere so they can check what's going on. It makes script kiddie stuff a little less likely, though a hacker specifically targetting a specific installation will likely be able to break in.
I've read various comments about viable this exploit is, and even submitted a link to someone's commentary to Slashdot about how it maybe overblown (https://eliastaylor.com/noexploit/) - The infosec community seems genuinely split on it, and I'm not sure this proof of concept is really going to convince anyone right yet.
The reality is we should probably not have acted as if a nuke went off last week, while at the same time we should patch it on a "just in case" basis. The 4 thing was more serious, and remains more serious given the number of IoT devices that'll accept 4 forever. This, on the other hand, is a good reason to stay up to date.
I am surprised it too that long (Score:3)
Well, as I have said multiple times now, amateur hour in IT and IT security is finally over. If nothing else substantial comes out of the LLM craze (and it looks like that) I will call that overall a win.
Re: (Score:1)
Would you have charged more than it cost OpenAI to find it?
Re: (Score:2)
Re: (Score:2)
It took that long to detect that it was successfully used.
It took that long just to find proof that the vulnerability had been successfully exploited. How many other systems had already been compromised before this one? We'll probably never know. (fixed that for me)
Re: (Score:2)
True.
Re: (Score:3)
Given how much vibe coded slop I'm seeing, I'd say amateur hour has just begun...
Re: (Score:2)
Well. Yes. And no. What I predict is that the field will split into amateurs and engineers and the distinction will become blatantly obvious.
Old vulneraibility, new exploit (Score:1)
Only the latter two were done with the help of AI.
AI will finally make the infrastructure safe (Score:3)
The Internet is literally glued together with "good enough to ship" code.
Sure, there will be pain at times but at the end of the day, it'll be more resilient. Don't think for a second foreign adversaries aren't looking for an angle to exploit, the same way we are.
Plus, Skynet needs a better backbone if it wants to be resilient.
No one mentioning .NET's OOB update from Sunday? (Score:3, Interesting)
Re: (Score:2)
That's just the broccoli2shell that also affected Node, Python, and a bunch of other systems: https://broccoli2shell.com/ [broccoli2shell.com]
An issue also raised last Wednesday.