FAOL EKSPLUATATSIYA CVSS v4 9.2 Reliz: 21.10.2026

PHP2Shell tekshiruvi

CVE-2026-109618 · CVE-2026-109619 — PHP'da autentifikatsiyasiz masofaviy kod bajarilishi (RCE). Saytingiz domenini kiriting: osin bitta oddiy so'rov bilan sarlavhalardagi PHP versiyasini o'qiydi. Hujum yoki zararli so'rov yuborilmaydi. Ro'yxatdan o'tish shart emas.

Ta'sirlangan versiyalar

Tarmoq	Zaif	Tuzatilgan
8.5	< 8.5.12	8.5.12
8.4	< 8.4.27	8.4.27
8.3	< 8.3.36	8.3.36
8.2	< 8.2.35	8.2.35
8.1 / 8.0 / 7.4	hammasi (EOL)	rasmiy reliz yo'q → 8.3+ ga o'ting

Ta'sirlanadi: Apache mod_php (eng yuqori xavf), PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. To'liq vaqtinchalik chora yo'q — yagona ishonchli yo'l yangilash.

0. Server ichida o'zingiz tekshiring

Tashqi tekshiruv versiya yashirilgan bo'lsa ko'rmaydi. CLI va veb-jarayon boshqa-boshqa PHP bo'lishi mumkin — ikkalasini ham ko'ring:

php -v | head -1
ls /etc/php/ 2>/dev/null; ls /www/server/php/ 2>/dev/null   # o'rnatilgan tarmoqlar
ps -eo cmd | grep -E 'php-fpm: master|apache2|httpd' | grep -v grep
docker ps --format '{{.Names}} {{.Image}}' | grep -i php

1. PHP'ni xavfsiz versiyaga yangilash

Debian / Ubuntu (ondrej/Sury ombori)

sudo apt update
apt list --upgradable 2>/dev/null | grep -E '^php'
sudo apt install --only-upgrade 'php8.3*'      # o'z tarmog'ingizni yozing: php8.2* / php8.4* ...
php -v | head -1                                # 8.3.36 yoki yuqori bo'lishi shart

RHEL / AlmaLinux / Rocky (Remi)

sudo dnf clean all && sudo dnf upgrade 'php*'
php -v | head -1

Docker

# Dockerfile: FROM php:8.3-fpm  →  aniq teg bilan qayta yig'ing
docker build --pull -t myapp/php:8.3.36 .
docker compose up -d --force-recreate php
docker exec <konteyner> php -v | head -1

aaPanel / manbadan yig'ilgan PHP

# eski konfiguratsiya flaglarini oling
/www/server/php/83/bin/php -i | grep 'Configure Command'
curl -fLO https://www.php.net/distributions/php-8.3.36.tar.xz
sha256sum php-8.3.36.tar.xz      # php.net/releases dagi SHA256 bilan solishtiring
tar xf php-8.3.36.tar.xz && cd php-8.3.36
./configure <yuqoridagi flaglar> && make -j"$(nproc)"
sudo cp -a /www/server/php/83 /www/server/php/83.bak   # zaxira
sudo make install

Paket menejeri yangi versiyani ko'rsatmasa — ombor hali yangilanmagan; vaqtinchalik chorani (3-bosqich) darhol qo'llang va ombordan reliz chiqishini kuting.

2. PHP worker'larini qayta ishga tushirish

Yangilangan kutubxona faqat jarayon qayta ishga tushganda yuklanadi. reload emas, restart qiling — eski master jarayon eski binar bilan qoladi.

sudo php-fpm8.3 -t && sudo systemctl restart php8.3-fpm   # Debian/Ubuntu
sudo systemctl restart php-fpm                               # RHEL
sudo /etc/init.d/php-fpm-83 restart                         # aaPanel
sudo apachectl configtest && sudo systemctl restart apache2   # mod_php
sudo systemctl restart lsws                                  # LiteSpeed
# navbat/cron worker'lari (supervisor, queue:work, systemd) ham:
sudo supervisorctl restart all

Tekshirish — eski binar bilan ishlayotgan jarayon qolmasin:

for p in $(pgrep -f 'php-fpm|php '); do sudo ls -l /proc/$p/exe 2>/dev/null; done | grep deleted || echo "OK: eski binar yo'q"

3. Vaqtinchalik chora: session.upload_progress

CVE-2026-109619 ning tasdiqlangan yo'lini yopadi; CVE-2026-109618 ni yopmaydi. Yangilaguncha qo'llang va keyin ham o'chiq qoldiring.

# FPM/Apache aynan qaysi php.ini ni o'qiyotganini toping (CLI'niki boshqa bo'lishi mumkin)
php --ini; ls /etc/php/*/fpm/php.ini /etc/php/*/apache2/php.ini 2>/dev/null

# har bir php.ini da:
sudo sed -i 's/^;\?\s*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' /etc/php/8.3/fpm/php.ini
grep -n 'session.upload_progress.enabled' /etc/php/8.3/fpm/php.ini

# yoki alohida fayl (conf.d)
echo 'session.upload_progress.enabled = Off' | sudo tee /etc/php/8.3/fpm/conf.d/99-php2shell.ini
sudo systemctl restart php8.3-fpm

Jonli tekshirish (CLI emas, aynan veb-jarayon):

echo '<?php var_dump(ini_get("session.upload_progress.enabled"));' | sudo tee /var/www/html/_p.php
curl -s https://SAYTINGIZ/_p.php     # string(0) "" yoki "0" bo'lishi kerak
sudo rm -f /var/www/html/_p.php      # albatta o'chiring

4. Apache mod_php va veb-server bo'yicha qo'shimcha himoya

mod_php → PHP-FPM. mod_php PHP'ni Apache jarayoni ichida ishlatadi va eng xavfli guruhda. FPM'ga o'ting: a2dismod php8.3 mpm_prefork && a2enmod mpm_event proxy_fcgi setenvif && a2enconf php8.3-fpm.
Versiyani yashiring. expose_php = Off (php.ini), ServerTokens Prod + ServerSignature Off (Apache), server_tokens off; (nginx). Bu tuzatish emas — faqat avtomatik skanerlar sizni kamroq topadi.
So'rov hajmini cheklang. LimitRequestBody / client_max_body_size, post_max_size, max_input_vars ni haqiqiy ehtiyojga tushiring; fayl yuklash kerak bo'lmagan joyda file_uploads = Off.
WAF qoidasi. Uzun yoki buzuq PHPSESSID cookie (masalan >128 belgi yoki [A-Za-z0-9,-] dan tashqari) va PHP_SESSION_UPLOAD_PROGRESS maydonli multipart so'rovlarni bloklang (ModSecurity / Cloudflare WAF).
Imtiyozlarni kamaytiring. Pool har sayt uchun alohida foydalanuvchida; disable_functions = exec,passthru,shell_exec,system,proc_open,popen (kerak bo'lmasa); open_basedir bilan papkani cheklang.

Buzilish izlarini qidiring (17.10.2026 dan beri faol hujum):

# xotira tugashi xatolari + 500 to'lqini
sudo grep -hE 'Allowed memory size|Out of memory' /var/log/php*fpm*.log /var/log/apache2/error.log 2>/dev/null | tail
sudo awk '$9==500' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
# so'nggi 10 kunda yaratilgan/o'zgargan PHP fayllar (veb-shell)
sudo find /var/www -name '*.php' -newermt '2026-10-14' -printf '%TY-%Tm-%Td %TH:%TM %u %p\n' | sort | tail -50

Manbalar: php.net ChangeLog · SOCRadar · OX Security. Faqat o'zingizga tegishli yoki ruxsat berilgan saytni tekshiring.