PHP2Shell: что известно об угрозе две недели спустя

Two weeks after PHP rushed out fixes for the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 — remote, unauthenticated code-execution bugs affecting roughly 70% of the world's websites — the picture has become clearer and grimmer. Researchers confirmed real-world exploitation starting around October 24, CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, and the company Dream reported that an attacker chained PHP2Shell with a Linux kernel bug called Fragnesia (CVE-2026-46300) to compromise 25 firewalls and management servers in the US, Japan, Taiwan and South Korea, later confirmed by Palo Alto Networks to involve PAN-OS management interfaces exposed online. A separate unpatched flaw, CVE-2026-115560, requiring an unusual configuration, was disclosed but left for a scheduled fix, while a second emergency PHP update addressed CVE-2026-111497 in the bundled Brotli library, already exploited by October 26. Despite the alarm, mass compromise hasn't materialized — exploits require matching specific PHP builds and app configurations — but Censys still finds 29 million of 46 million scannable vulnerable servers unpatched, so updating to the latest PHP builds and auditing systems for compromise signs remains essential.