# PHP2Shell: iziphoso ezimbili ezibucayi ze-PHP, ukuvinjelwa okuputshukile, nokuthi yini eyaziwayo mayelana nokuxhaphaza

Published: 2026-10-22

I-PHP ikhiphe izilungiso eziphuthumayo zamaphutha amabili abucayi okwenziwa kwekhodi ekude, i-CVE-2026-109618 kanye ne-CVE-2026-109619, abizwa nge-PHP2Shell. Ukukhishwa kwenzeka ngo-Okthoba 21, 2026. Lesi siqephu sichaza amaphutha amabili ememori ngamagama alula, ukuthi kungani umkhondo ovela ekuhlolweni kuka-2024 walinda ukulungiswa, ukuthi ukuvinjelwa kwavela kanjani, nokuthi imaphi amakhasi athini mayelana nokuxhashazwa. Kuphinde kuhlanganise nokukhishwa kwephetshi elibucayi le-GitLab ngosuku olufanayo kanye ne-oda lenhlawulo ye-Meta elingama-dollar ayizigidi ezingama-25 eNew Mexico.

Canonical: https://thedailydiff.dev/zu/video/2026-10-22-php2shell/

## Lokho okuhlanganiswa yile vidiyo

- Zombili iziphoso zilinganiselwe ku-9.2 ku-CVSS v4.0 yithimba le-PHP. Izinguqulo ezilungisiwe yi-PHP 8.2.35, 8.3.36, 8.4.27 kanye ne-8.5.12; i-PHP 7.4, 8.0 kanye ne-8.1 zithole ama-patch omthombo kuphela. I-PHP ithi ukubuyekeza ukuphela kwesisombululo esiphelele.
- Iphutha lokuqala livela ku-PHP ishiya isicelo singakakhiwa kahle lapho iphelelwa inkumbulo ngesikhathi esingafanele. Elesibili livela kumkhombi osele wenkumbulo yesicelo esisodwa ongasebenziswa isicelo esilandelayo kumsebenzi ofanayo. Ku-Apache ene-mod\_php indlela yokuqala isebenza ngaphambi kwekhodi yohlelo lokusebenza.
- Umakhi oyinhloko we-PHP wathola izimpawu zokuqala zenkinga yenkumbulo ngesikhathi kuhlolwa ngo-2024. I-PHP Foundation ithi ukulungiswa okuphikisayo kwakunezinkinga futhi ithimba lezokuphepha elisekelwe ekuvumelaneni lalihlukumezeka ukukhetha, elikubiza ngokuthi ukwehluleka kwesakhiwo.
- I-Foundation ithi izinombolo ze-CVE zaputshuka ngo-Okthoba 20, i-Calif yashicilela ngengozi ividiyo ye-proof-of-concept, futhi i-Chainguard yashicilela izithombe ezakhiwe nge-fix ngaphezu kwamahora ayisithupha ngaphambi kokukhishwa. Umphathi we-Chainguard uthi abantu basebevele behlaselwa nokuthi wathola iziphoso ngokuzimela.
- Amakhompiyutha awavumelani mayelana nokuxhaphaza. I-Amazon yashicilela umzamo ngo-Okthoba 17 futhi kamuva yathi i-PHP2Shell yayixhaphazwa kabanzi. I-watchTowr yabika ukuxhaphazwa endle. I-CISA yayingakuboni ukuxhaphazwa ngesikhathi kushicilelwa, futhi ithimba le-PHP alitholanga ukuxhaphaza okusebenzayo ngesikhathi kukhishwa. Iningi lezifanekiso ze-proof-of-concept ezishicilelwe kubikwa ukuthi azisebenzi.
- Hlola zonke izindawo lapho i-PHP isebenza khona, okuhlanganisa namakhophi ngaphakathi kwezinye izofthiwe, buyekeza, qala kabusha abasebenzi futhi ubuyekeze izingodo kuze kufike ngo-Okthoba 17.

## Imibuzo nezimpendulo

### Ziyini iziphazamiso ezimbili ze-PHP2Shell?

I-PHP2Shell iqamba iziphazamiso ezimbili ezibucayi ze-PHP, i-CVE-2026-109618 ne-CVE-2026-109619, zombili zilinganiselwe ku-9.2 yithimba le-PHP. Eyesokuqala ishiya isicelo singakakhiwa kahle lapho i-PHP iphelelwa inkumbulo ngesikhathi esingalungile, bese ukuhlanzwa kukuethemba. Eyesibili ishiya inkomba kwinkumbulo yesicelo esisodwa engasetshenziswa isicelo esilandelayo kumsebenzi ofanayo. Zombili zingaholela ekukhipheni ikhodi ngaphandle kokungena ngemvume.

### Yiziphi izinhlobo ze-PHP ezine-fix ye-PHP2Shell, kuthiwani ngezinguqulo ezingasekelwe?

Iphrojekthi ye-PHP ikhiphe izilungisiro ku-8.2.35, 8.3.36, 8.4.27 kanye no-8.5.12 ngo-Okthoba 21. Ngo-7.4, 8.0 kanye no-8.1 yashicilela ama-patch omthombo kuphela, futhi i-BleepingComputer ibika ukuthi abasakazi nabathengisi bokusekela isikhathi eside bangahlinzeka ngezilungisiro ezibuyisiwe. I-PHP ithi ayikho indlela yokuzivikela ephelele, ngakho ukubuyekeza noma ukucela umthengisi iphakheji elilungisiwe yikona kuphela okukhethekayo okuphephile.

### Kungani isiphazamiso senkumbulo ye-PHP esaziwayo sithathe isikhathi eside kuze kube u-Okthoba 2026 ukulungiswa?

I-PHP Foundation ithi umakhi oyinhloko wathola izimpawu zokuqala zenkinga yenkumbulo ngesikhathi sokuhlolwa kwezokuphepha ngo-2024, kodwa ayikho indlela yokuxhaphaza eyaziwayo futhi konke ukulungiswa okungaba khona kwakunezinkinga ezinjengokwephula ukuhambisana. Ithimba lezokuphepha linquma ngokuvumelana futhi lalihlukumezeka ukukhetha, okubizwa yi-Foundation ngokuthi ukwehluleka kwesakhiwo okubangelwa inqubo yayo yokunquma kanye nokuntuleka kwezinsiza.

### Ingabe i-PHP2Shell iyaxhaphazwa, futhi kulula kangakanani ukuyixhaphaza?

Amakhompiyutha awavumelani. I-Amazon yashicilela umzamo wokuxhaphaza ngo-Okthoba 17 futhi kamuva yathi i-PHP2Shell yayixhaphazwa kabanzi, futhi i-watchTowr yabika ukuxhaphazwa endle. I-CISA yayingakuboni ukuxhaphazwa ngesikhathi kushicilelwa, futhi ithimba le-PHP aliboni ukuxhaphaza okusebenzayo ngesikhathi kukhishwa. I-watchTowr ithi iningi lama-script okuxhaphaza omphakathi aphahlazeka noma awenzi lutho, futhi i-VulnCheck yathola ukuthi ukukhipha ikhodi kusebenza kuphela kwezinye izilungiselelo.

### Sasisithini isahlulelo se-The Daily Diff nge-PHP2Shell?

Isahlulelo se-The Daily Diff sasiyi-SHIP IT: thumela isibuyekezo se-PHP kusihlwa, ngoba inguqulo entsha yiyona kuphela ephelele yokulungisa. I-CISA ithi hlola yonke isistimu esebenzisa i-PHP, okuhlanganisa namakhophi angaphakathi kwezinye izofthiwe, faka i-patch, bese ukhipha izistimu ze-PHP ku-inthanethi uma zingakwazi ukubuyekezwa. I-Amazon iphakamisa ukubuyekeza izingodo kuze kufike ngo-Okthoba 17, lapho ibona umzamo wokuqala.

## Izahluko

- 0:00 Ubani ozame i-PHP2Shell ezinsukwini ezine ngaphambi kwesikhathi?
- 0:41 Ziyini iziphoso ezimbili ze-PHP2Shell?
- 1:37 Kungani isiphoso esaziwayo silinde iminyaka emibili?
- 1:54 Ubani owathola i-PHP2Shell, futhi kanjani?
- 2:20 Uputshuke kanjani ukuvinjelwa kwe-PHP2Shell?
- 2:50 Ingabe i-PHP2Shell iyaxhaphazwa, futhi ngobani?
- 3:43 Yini uhulumeni ayikhiphe ku-inthanethi?
- 4:11 Yiziphi izinhlobo ze-PHP ezithola ukulungiswa?
- 4:30 Wenzani nge-PHP2Shell kusihlwa?
- 4:45 Yini enye ekhiphe i-patch ebucayi ye-RCE namuhla?
- 5:01 Kungani uMeta ayalwe ukukhokha u-$25 billion?
- 5:18 Iyiphi indlela yokuzivikela ye-Chainguard yokulungisa ngaphambi kwesikhathi?
- 5:38 Yini ethola isitembu se-SHIP IT?

## Umbhalo obhaliwe ohunyushwe

Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube.

### Ubani ozame i-PHP2Shell ezinsukwini ezine ngaphambi kwesikhathi?

0:00 Ukuvinjelwa kwezokuphepha kufanele kugcine isiphoso sithule kuze kuphume i-patch. I-Amazon yashicilela umzamo wokulwa nesiphoso esibucayi se-PHP ezinsukwini ezine ngaphambi kwesikhathi. Kule vidiyo, ubani owakuthola? Uputshuke kanjani ukuvinjelwa? Futhi kubi kangakanani, ngempela? Futhi inkampani esolwa ngokuvuza inezivikelo engingazilindele. Ngizokufinyelela. KungoLwesine, Okthoba ngama-22, futhi lokhu yi-The Daily Diff.

0:21 I-PHP wulimi lokubhala olwakha amakhasi ewebhu kuseva ngaphambi nje kokuba akufinyelele. Iminyaka engaphezu kwamashumi amathathu ubudala futhi, ngokulinganisa okukodwa, isebenzisa amaphesenti angama-70 amawebhusayithi, okuhlanganisa ne-WordPress nesofthiwe ngemuva kwe-Wikipedia. Abathuthukisi bayathanda ukuyihleka usulu, ngokuvamile bephuma ekhasini i-PHP elibahlinzeka ngalo. Ukuyigcina kuyinzuzo engenzi nzuzo enonjiniyela abayishumi nantathu.

### Ziyini iziphoso ezimbili ze-PHP2Shell?

0:41 NgoLwesithathu, i-PHP ikhiphe ukulungiswa okuphuthumayo ngeziphoso ezimbili ezibucayi ezivumela umuntu ongamazi ukuba asebenzise ikhodi kuseva ngaphandle kokungena ngemvume. Ngokubambisana zibizwa nge-PHP2Shell, futhi zibuyela emuva ku-PHP five point four. Nasi isiphoso sokuqala ngamagama alula. I-PHP inikeza isicelo ngasinye isabelomali senkumbulo. Uma isicelo sifinyelela leso sibalo ngesikhathi esingafanele, I-PHP iphuma ngokushesha bese ishiya isicelo singakakhiwa kahle. Bese isinyathelo sokuhlanza sithemba into engakakhiwa kahle.

1:07 Isiphoso sesibili siyasala. Iphutha elibi lingashiya inothi elikhomba inkumbulo eyayeyeyesicelo sokugcina. Umsebenzi ofanayo uphatha isicelo esilandelayo bese ulandela inothi. Ngaleso sikhathi omunye umuntu uhlala kulelo kheli. Ku-Apache ene-mod PHP, umonakalo wenzeka ngaphambi kokuba ikhodi yakho isebenze, ngakho ikhasi lakho lokungena alitholi i-vote. U-Wiz uthi ngisho ne-script ye-hello world ibonakalisiwe. Ukulungiswa kususa ukuphuma okuphuthumayo kwe-PHP ngenxa yokuphelelwa inkumbulo.

1:32 Esikhundleni sokuphuma phakathi nesicelo, i-PHP manje imisa kahle endaweni ephephile elandelayo. Ingxenye eyinqaba ukuthi iseluleko sokuqala sase sikhulile kangakanani.

### Kungani isiphoso esaziwayo silinde iminyaka emibili?

1:39 Ngo-2024, ukuhlolwa kwezokuphepha kwangaphandle kwaholela umakhi oyinhloko we-PHP ezimpawini zokuqala zenkinga yenkumbulo. Ayikho i-exploit eyaziwayo, futhi konke ukulungiswa kwaphula okuthile. Ithimba elinquma ngokuvumelana lalingakwazi ukukhetha, ngakho isiphoso salinda. Bese ngo-Agasti, abatholi bafika ezinsukwini ezimbalwa.

### Ubani owathola i-PHP2Shell, futhi kanjani?

1:56 Umshicileli we-Calif u-Ryan Austin wakuthola ngo-Agasti kuqala, esebenza ngohlelo lwe-OpenAI lwe-Patch the Planet. I-OpenAI yabika isizathu esifanayo ngokuzimele. U-Wiz wathola izinhlobo ezahlukene emasontweni ambalwa kamuva ngamamodeli we-Gemini ne-GPT. U-Austin uthi usebenzise amamodeli noma ubani angawathola, kanye nethiyori mayelana nalapho iziphoso ezindala ze-PHP zifihleke khona. I-OpenAI ithi i-AI yomngcele yayiyisihluthulelo. Isiphoso sase sifihleke iminyaka engaphezu kweshumi. Ukukhishwa kwakuhlelelwe uLwesine.

### Uputshuke kanjani ukuvinjelwa kwe-PHP2Shell?

2:21 NgoLwesibili, izinombolo ezimbili ze-CVE zaqala ukusakazwa ku-inthanethi, ngesikhathi sokukhishwa esingalungile kanye nesikolo esingalungile seziyishumi. I-PHP ikhiphe ukukhishwa phambili ngosuku olulodwa. Ngaleso sakusihlwa, i-Calif yashicilela ngengozi ividiyo ye-proof of concept yayo isebenza, futhi amakhophi asinda ekususweni. NgoLwesithathu ekuseni, ngaphezu kwamahora ayisithupha ngaphambi kokukhishwa, I-Chainguard yashicilela izithombe ezakhiwe eziqukethe ukulungiswa. I-PHP ithi noma yimuphi umhlaseli angasifunda leso silungisiro ngenkathi bonke abanye belinde.

2:46 I-patch futhi iyi-diff, futhi abahlaseli bafunda ama-diff.

### Ingabe i-PHP2Shell iyaxhaphazwa, futhi ngobani?

2:50 Ngubani-ke oqinisileyo ohlaselekile? I-honeypot ye-Amazon yashicilela umzamo ngo-Okthoba neshumi nesikhombisa futhi kamuva yathi I-PHP2Shell ixhaphazwa kabanzi. I-watchTowr ibika ukuxhaphazwa endle. I-Cisa ithi ayikuboni lapho ishicilelwe, futhi ithimba le-PHP aliboni ukuxhaphaza okusebenzayo ngesikhathi kukhishwa. Umphathi we-Cloudflare uthe wabona izinkulungwane zemizamo emahoreni ayishumi ngaphambi kokuba isimemezelo, nezigidi ngoLwesine ekuseni.

3:13 I-Amazon iqaphele ephuzwini elilodwa. Ayazi noma imizamo yayo yokuqala yayizosebenza yini ku-system yangempela. Umzamo uwukuqopha nje emnyango. Kubi kangakanani-ke, ngempela? I-watchTowr ithi izinhlelo zokuxhaphaza zomphakathi ezisakazekayo ikakhulu ziyaphahlazeka noma azikwenzi lutho. I-VulnCheck ithi ukukhipha ikhodi kusebenza kwezinye izilungiselelo, futhi ayikho kwezomphakathi ihlula ukuhlelwa okungahleliwe kwenkumbulo kumaseva ajwayelekile e-x86. Umshicileli u-Elias Taylor uthi akukude njengoba kulula njenge-Log4Shell.

3:40 Wonke umuntu usasho i-patch. Uhulumeni akazange alinde isahlulelo.

### Yini uhulumeni ayikhiphe ku-inthanethi?

3:44 I-NSA yatshela izinhlangano ezingakwazi ukulungisa ukuthi zikhiphe izinhlelo ze-PHP ku-inthanethi, futhi i-National Cyber Security Centre yase-UK yanikeza iseluleko esifanayo. Amawebhusayithi ase-Dutch, okuhlanganisa nesevisi yezazisi zedijithali kazwelonke, ayeka ukusebenza, kanye newebhusayithi yamaphoyisa aseParis. I-Wikimedia ikhiphe izinhlelo eziningana njengesixwayiso. I-Palo Alto Networks ibale izikhathi ezingaphezu kweziyizigidi ezingamashumi amabili nambili ezidaluliwe. Futhi uprofesa wase-Australia wenze iphuzu elibukhali kakhulu. Amawebhusayithi okufanele ukhathazeke ngawo yilawo angakancishiswanga namuhla.

### Yiziphi izinhlobo ze-PHP ezithola ukulungiswa?

4:11 Ukulungiswa kukhona nge-PHP eight point two kuya kweyisishiyagalombili point five. Nge-seven point four, eight point oh kanye ne-eight point one, I-PHP yashicilela ama-patch omthombo kuphela. Izinguqulo ezindala azitholi lutho kuphrojekthi ye-PHP, ngakho buza umthengisi wakho. Ama-workaround anciphisa amathuba, kodwa i-PHP ithi ukubuyekeza ukuphela kwendlela ephelele yokulungisa. Yisifundo esifanayo nesiqephu se-eMudhra sayizolo,

### Wenzani nge-PHP2Shell kusihlwa?

4:32 ngoba ukuba khona kokulungiswa akufani nokuqhubeka kwenqubo ekukona. Thola zonke izinhlelo ze-PHP ku-stack yakho, ngisho namakhophi afihliwe ngaphakathi kwezinye izofthiwe. Buyekeza, qala kabusha abasebenzi, bese uhlola izingodo kuze kufike ngo-Okthoba neshumi nesikhombisa. Ngosuku olufanayo, i-GitLab ikhiphe i-patch release ebucayi,

### Yini enye ekhiphe i-patch ebucayi ye-RCE namuhla?

4:47 ishumi nesishiyagalolunye point five point one. Ukugeleza kwenamba kumhlanganisi wayo wamagama ajwayelekile kuvumela umsebenzisi ongagunyaziwe ukuba asebenzise ikhodi kuseva, futhi ulinganisa ishumi kwayishumi. I-GitLab dot com isivele ilungisiwe. Ukufakwa okuzihambelayo kudinga ukubuyekezwa.

### Kungani uMeta ayalwe ukukhokha u-$25 billion?

5:01 Ngaleso sikhathi eNew Mexico, ijaji layala i-Meta ukuthi ikhokhe u-$25 billion ezijezisini mayelana ne-Cambridge Analytica. Ijure labala ukwephulwa komthetho okungaphezu kwezigidi ezingamashumi amane nantathu kuze kufike ezinkulungwaneni ezinhlanu zamadola ngakunye, okwafinyelela cishe kumabhiliyoni angamakhulu amabili namashumi amabili ngaphambi kokuba ijaji liwakwehle. U-Meta uthi uzowina esicelweni. Manje ukuzivikela engikuthembisile.

### Iyiphi indlela yokuzivikela ye-Chainguard yokulungisa ngaphambi kwesikhathi?

5:19 Umphathi we-Chainguard utshele i-The Register ukuthi wathola iziphoso ezifanayo yena ngoLwesihlanu ebusuku, ngemuva kokwazi ukuthi kukhona okuzayo ku-PHP, ngesikhuthazo esiyisisekelo sokuthola iziphazamiso ezimbi. Uthi ukhishwe ngaphambi kwesikhathi ngoba abantu basebevele behlaselwa. Uma ukhetha ukukufunda lokhu kunokuba ungizwe ngisho, i-diff ifika ebhokisini lakho leposi njalo ekuseni, mahhala ku-the daily diff dot dev, isixhumanisi ngezansi. Ngakho isahlulelo sanamuhla yi-SHIP IT.

### Yini ethola isitembu se-SHIP IT?

5:39 Thumela isibuyekezo se-PHP kusihlwa, ngoba inombolo entsha yenguqulo iyona kuphela ephelele ukulungiswa. Futhi lokho yindaba yanamuhla. NginguNiko ovela ku-Axrisi. Hlanganisa ngokuzibophezela.

## Imithombo

- [Today's PHP Security Release, and How We're Strengthening PHP Security](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) — The PHP Foundation
- [RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) — PHP security advisory
- [RCE via stale global state (GHSA-6wmf-4rv5-p3rp)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) — PHP security advisory
- [Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php) — php.net
- [php2shell](https://calif.io/php2shell/) — Calif
- [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](https://www.wiz.io/blog/php2shell-php-rce) — Wiz Research
- [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) — AWS Security Blog
- [Critical Vulnerabilities in PHP Require Immediate Patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) — CISA
- [Flaw in PHP computer language leads to shutdown of websites around world](https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world) — The Guardian
- [What is PHP, and how bad is the computer language flaw causing website shutdowns globally?](https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns) — The Guardian
- [PHP2Shell Exploitation Started Days Before Patches](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/) — SecurityWeek
- [PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619](https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619) — Tanium
- [There isn't an easy exploit for this PHP vulnerability](https://eliastaylor.com/noexploit/) — Elias Taylor
- [PHP blames supply chain security biz Chainguard for putting entire web at risk](https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-entire-web-at-risk/5304611) — The Register
- [PHP2Shell: 22M exposed servers at risk as emergency patches released](https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released) — TechTarget
- [PHP ships emergency patches for critical PHP2Shell flaws](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) — BleepingComputer
- [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) — GitLab
- [Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica case](https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html) — CNBC
- [Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming](https://news.ycombinator.com/item?id=50167754) — Hacker News