Special edition: CVE-2926-109618 (Update #3)

Good morning, this is a special edition of It's Probably Nothing on PHP2Shell, the two PHP core flaws. Patches are available, and reported exploitation now includes a successful compromise. This assessment is current to 6:25am New Zealand daylight time on 23 October.

Since our last assessment, we've moved beyond watchTowr's reported exploitation attempts. Sophos's 22 October update reports successful exploitation and malware execution, apparently a Mirai variant called potassium. That's Sophos's observation, not an independently inspectable victim investigation. It hadn't seen evidence connecting the activity to ransomware, data theft or supply-chain compromise.

AWS now dates an exploitation attempt against its MadPot system to 17 October. That doesn't establish whether it would've succeeded against a real system, or how the actor obtained exploit information. AWS recommends investigating from at least that date, not from disclosure.

VulnCheck also says its commercial exploit for the first flaw achieved remote code execution on PHP 8.4.26, on 64-bit x86, with address randomisation enabled and PHP error display disabled. Its ARM64 remote code execution attempt failed. Those are specific test conditions, not universal exploitability.

The wider timeline matters here. Wiz says it reported the flaws on 24 August. Their existence leaked publicly on 20 October, and PHP released fixes on 21 October. The newly reported AWS attempt predates that public leak.

Both are PHP-core lifecycle bugs, rated 9.2 under CVSS version four. The first leaves incompletely initialised memory reachable after an out-of-memory abort. The second leaves freed request state available for a later request in the same worker to consume. These aren't application-framework bugs.

PHP puts all web-serving installations in scope. mod_php has the highest demonstrated risk, including code execution before application code runs. PHP hasn't demonstrated a complete FPM exploit for the first flaw. The second has confirmed code execution paths against both mod_php and FPM, with the validated FPM path requiring suitable application behaviour after startup. FPM isn't an exemption. Code runs with the web worker's privileges, not automatically as root. The second flaw can also disclose memory.

Upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can retain older-looking version numbers: Ubuntu 24.04 has a package fixing both flaws. Check the full package build. Minimal source backports also exist for PHP 7.4, 8.0 and 8.1, without restoring normal support.

AlmaLinux's remaining fixes have now reached production, with its production rollout beginning at 21:15 UTC on 21 October. Use its production repositories and verify the package build. On Laravel Forge, automatic security updates exclude PHP: update every installed version and restart long-running processes. PHP says configuration workarounds aren't a complete solution.

And don't stop at websites. New Zealand's NCSC also flags PHP embedded in firewalls, edge devices and other platforms, which may need separate vendor remediation. Patching doesn't remove an existing compromise. Victim numbers, campaign scale, and New Zealand and Australian impact remain unresolved.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.