Fenz AI 紧急安全审计简报 / Fenz AI Emergency Security Audit Brief 报告编号 / Report ID: FE… · @fenzlabs · TwKit

@fenzlabs

Fenz AI 紧急安全审计简报 / Fenz AI Emergency Security Audit Brief 报告编号 / Report ID: FENZ-2026-1021-PHP2SHELL 主题 / Subject: PHP2Shell — 两个超高危未认证远程代码执行漏洞（CVE-2026-109618 & CVE-2026-109619） 严重程度 / Severity: Critical（严重，CVSS v4.0 9.2） 审计方 / Auditor: Fenz AI — Hospital for Agents（代理医院）Security Research 日期 / Date: 2026-10-21 VERDICT: BLOCK / IMMEDIATE PATCH（立即阻断并升级） 一、核心结论 / Executive Summary 中文 今天，PHP 编程语言爆出两个超高危漏洞，合称 PHP2Shell。攻击者无需登录，只需发送一个精心构造的请求，即可在目标服务器上实现远程代码执行（RCE），进而植入木马、窃取数据或瘫痪网站。该漏洞位于 PHP 引擎核心，而非应用层代码，因此即使网站自身代码干净，只要运行在受影响的 PHP 版本上，同样中招。全球暴露在互联网上的 PHP 服务器规模庞大，Cloudflare 已观测到早期攻击流量。芬兰、荷兰、法国等国政府网站已紧急下线，英国 NCSC 建议无法立即修补的系统先下线。 English Today, two critical vulnerabilities in the PHP programming language, collectively known as PHP2Shell, were disclosed. An attacker needs no login — a single specially crafted request can achieve remote code execution (RCE) on the target server, enabling malware installation, data theft, or site takedown. The flaws sit in the PHP engine core rather than application code, so even clean applications are vulnerable if they run on an affected PHP version. The number of internet-exposed PHP servers is massive. Cloudflare has already observed early attack traffic. Government websites in Finland, the Netherlands, and France have been taken offline as a precaution, and the UK NCSC advises systems that cannot be patched immediately to go offline. 二、技术发现 / Technical Findings 中文 CVE-2026-109618：Out-of-Memory（OOM）处理导致内存损坏，可使内部请求数据仅部分初始化后被当作有效数据处理，进而实现 RCE。 CVE-2026-109619：请求结束后全局状态残留，导致 use-after-free、内存泄露或 RCE。 两者均可在应用代码执行前触发（尤其在 mod_php 环境下风险最高）。 受影响版本：从 PHP 5.4 起至未修补的 8.x（官方补丁仅覆盖 8.2+；EOL 版本需依赖发行版或源码移植）。 发现方：Calif（OpenAI “Patch the Planet” 项目）、Wiz 等，借助 AI 辅助发现。 证据：Cloudflare CTO 确认已见早期攻击；多个政府网络安全机构发布紧急通告。 English CVE-2026-109618: Out-of-memory (OOM) handling corrupts internal request data, allowing partially initialized structures to be treated as valid and leading to RCE. CVE-2026-109619: Stale global state survives request shutdown, enabling use-after-free, memory disclosure, or RCE. Both can be triggered before application code runs (highest risk on mod_php). Affected versions: PHP 5.4 through unpatched 8.x (official patches cover 8.2+; EOL branches rely on distro backports or source patches). Discovered by Calif (OpenAI “Patch the Planet”), Wiz, and others, with AI assistance. Evidence: Cloudflare CTO confirmed early attacks; multiple national cybersecurity agencies issued urgent advisories. 三、攻击轨迹示例 / Example Attack Trajectory fenz://audit/trace/php2shell.replay $ fenz replay --target php_web_server --vector unauthenticated → loading trajectory… OK [t=00:00.1] request.inbound = crafted HTTP request (no auth) [t=00:00.4] php.engine = OOM / stale-state trigger ✗ MEMORY_CORRUPTION ⚠ AX.03 execution_integrity + AX.02 permission_boundary cause: core runtime flaw before app code [t=00:00.7] http://tool.call = arbitrary_code_execution (as www-data) [t=00:01.2] outcome = shell / data exfil / site disruption VERDICT: BLOCK · 2 findings · 2 critical FIX: immediate upgrade to patched PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 + WAF rules as temporary stopgap only evidence bundle → http://fenz.ai/r/php2shell 四、影响范围 / Impact 中文 PHP 支撑全球大量网站与应用（WordPress、Drupal、Magento、Laravel、政府门户等）。一次成功利用即可完全控制网站服务器进程。已有早期攻击现象，预计补丁公开后将出现大规模利用。无法立即升级的系统面临持续高风险。 English PHP underpins a vast portion of the global web (WordPress, Drupal, Magento, Laravel, government portals, etc.). Successful exploitation grants full control of the web worker process. Early attacks have already been observed, and mass exploitation is expected once patches and write-ups are public. Systems that cannot be upgraded immediately remain under continuous high risk. 五、修复建议 / Recommended Remediation 中文 立即升级：升级至 PHP 8.5.12、8.4.27、8.3.36 或 8.2.35（或发行版提供的等价补丁）。 无法升级则下线：EOL 版本或暂时无法修补的系统，按 NCSC 等机构建议，先从公网隔离或下线。 临时缓解：启用 Cloudflare 等厂商已部署的 WAF 规则（仅作权宜之计，不能替代补丁）。 清点资产：全面扫描环境中所有 PHP 实例（包括嵌入式、容器、托管平台）。 持续监控：关注官方与安全厂商后续通告，验证补丁后重新上线。 English Upgrade immediately: Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or equivalent vendor backports). Take offline if unpatchable: Isolate or shut down EOL or temporarily unpatchable systems per NCSC and peer-agency guidance. Temporary mitigation: Enable vendor WAF rules (e.g., Cloudflare) as a stopgap only — not a substitute for patching. Inventory assets: Scan all PHP instances, including embedded, containerized, and hosted environments. Monitor continuously: Track official and vendor advisories; re-enable only after verified patching. 六、结论 / Conclusion 中文 这不是应用层的小漏洞，而是 PHP 运行时本身的行为完整性崩溃。输出看起来正常的网站，其底层引擎已可被单请求控制。Fenz 建议：能补的立刻补，不能补的先下线。 English This is not an application-level bug — it is a collapse of execution integrity in the PHP runtime itself. Sites that appear to function normally can be controlled by a single request. Fenz recommends: patch what can be patched immediately; take offline what cannot. 完整证据与持续更新请关注官方 PHP 公告及 http://fenz.ai。 For full evidence and ongoing updates, refer to official PHP advisories and http://fenz.ai.

曝光 9 · 评论 0 · 点赞 1 · 书签 0